1

Using iptables, how do I drop an entire subnet that I am connected to, except for the gateway, in a manner that still allows me to retain my connectivity to it?

I'm looking for two iptables rules, one for just incoming, and another for outgoing.

For example, let's say I want to connect to gateway 10.0.0.1, with an IP .159 I want to block everything else, and need to retain connectivity, DNS is set to gateway, 10.0.0.1.

Improve this question
1
  • This should be in linux substack.
    – elsadek
    Commented Jul 4, 2020 at 12:05

1 Answer 1

Reset to default
1

When iptables rules are checked they go in order of rules being entered in through all rules. So in my opinion you should first accept traffic from/to 10.0.0.1 and then reject all other traffic from the subnet. When you will have traffic for 10.0.0.1 it will be accepted with the first rule and everything else will be rejected with the second rule. So, I would write something like this:

iptables -t INPUT -s 10.0.0.1 -j ACCEPT
iptables -t INPUT -s 10.0.0.0/8 -J REJECT

iptables -t OUTPUT -d 10.0.0.1 -j ACCEPT
iptables -t OUTPUT -d 10.0.0.0/8 -J REJECT

This is just an addition to be added to the other rules, which should already be in place. I assume you use 255.0.0.0, since this is the default for 10.X.X.X networks. If not, use another netmask. I am also not sure if just specifying source (-s) and destination (-d) is enough. Maybe you need to add network interface (-i), protocol (-p), etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .