2

I have a server with 2 interfaces. a small netework connects to eth0 and gets out to internet on eth1. To allow 1 ip to nat I use

iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.23 -j SNAT --to-source=23.x.x.x

I would like to add a rule that allow a single ip do nat and block the others already existing in iptables(without deleting them)

iptables -t nat -A POSTROUTING -o OUT_IF \! -s ip_sursa -j SNAT --to-source=x3.xxx.1xx.1xx -j DROP

would work?

Or, to allow only 1 ip to pass over eth0 to eth1 and do nat.

Improve this question

1 Answer 1

Reset to default
3

It is not recommended to use DROP in the NAT table. It is better to do this the filter table if you want to deny the access to these IP addresses.

Otherwise, you can use a different rule to NAT these IPs to a different public IP.

Update

Here are the rules you need to allow only one IP (192.168.0.100)

iptables -A FORWARD -o eth1 -s 192.168.0.100 -j ACCEPT
iptables -A FORWARD -o eth1 -s 192.168.0.0/24 -j DROP
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.100 -j SNAT --to-source=23.x.x.x
Improve this answer
6
  • so...how can I do it? How to allow only 1 ip pass from eth0 to eth1?
    – Linux_begnr
    Jul 16, 2011 at 11:53
  • You can use iptables -A FORWARD -o OUT_IF -s IP_range -j DROP.
    – Khaled
    Jul 16, 2011 at 14:35
  • the ip i want to allow is 192.168.0.100. I want to block all the others.How to give the range from 0-99 and 101-254(with 192.168.0.0/24 i will block all class). can i give IP_range=192.168.0.1-192.168.0.99 and 192.168.0.101-192.168.0.254 and make 2 rules?
    – Linux_begnr
    Jul 16, 2011 at 16:43
  • "iptables -A FORWARD -o OUT_IF -s IP_range -j DROP" without "-t nat"?I need nat
    – Linux_begnr
    Jul 16, 2011 at 17:37
  • iptables -A FORWARD -o OUT_IF -m iprange --src-range 192.168.1.0-192.168.1.99 -j DROP and iptables -A FORWARD -o OUT_IF -m iprange --src-range 192.168.1.101-192.168.1.254 -j DROP would work?
    – Linux_begnr
    Jul 17, 2011 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .