Ubuntu 18.04 Server Internal and External network configuration

Question

I have issue in Ubuntu 18.04 Server to configurate internal and external network. Case is that i have Gateway device which has DHCP service to lease IP addresses for wlan connected devices. Gateway device eth0 IP address is 192.168.1.120 and Gateway device wlan0 has static 10.10.0.1 IP address and first wlan client gets 10.10.0.2 IP address. Gateway device eth0 has internet access. But wlan0 connected devices should only have access to Gateway device services e.g. MySql or custom REST API's.

Rule 1: Gateway device should have access to internet.

[eth0]<-->[Internet]

Rule 2: Wlan connected devices should have only access to Gateway device services.

[WlanClient]<-->[wlan0]<-->[eth0]--||NoAccess||--[Internet]

What i have done is that i have installed Ubuntu 18.04 Server and installed basic services and now i'm in point that i should create network restrictions.

I have done following settings to get wlan0 connected devices to be able to use Gateway device services. But also wlan0 connected devices has now internet access which should be restricted.

/etc/sysctl.conf

net.ipv4.ip_forward=1

iptables configuration

iptables -F
iptables -t nat -F
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables-save  > /etc/iptables/rules.v4
iptables-restore  < /etc/iptables/rules.v4

Can some one help me with the configuration?

Answer 1

To solve your problematic, you have to work with the FORWARD chain of the filter table. The FORWARD tables is used to filter every packet that are to or from the host. (At contrary, the INPUT table is for incoming trafic, OUTPUT table for outgoing trafic). There's actually two approaches:

1/ You limit all the trafic and open on a per-need basis:

iptables -t filter -P FORWARD DROP

iptables -t filter -A FORWARD [your rule #1 to match allowed streams(s)] -j ACCEPT

2/ You limit the trafic only for the devices you want restrict access:

iptables -t filter -P FORWARD ACCEPT
iptables -t filter -A FORWARD [your rule #1 to match forbidden stream(s)] -j REJECT --reject-with admin-prohib

Usually, the good practice in terms of security is the 1st approach.