I have a gateway machine connected to multiple internal networks that I would like to set up NAT on. The catch, though, is that these networks need to be isolated from each other, which I haven't been able to figure out. Here's my configuration:
eth0: 192.168.1.0/28 (upstream), gateway is assigned 192.168.1.1
eth1: 192.168.1.16/28 (downstream 1), gateway is assigned 192.168.1.16
eth2: 192.168.1.32/28 (downstream 2), gateway is assigned 192.168.1.32
So far, I've configured iptables to allow on default chains:
iptables -P INPUT ALLOW
iptables -P OUTPUT ALLOW
iptables -P FORWARD ALLOW
Then, I've enabled IP forwarding in the kernel and set up iptables:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 192.168.1.1
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth2 -o eth0 -j ACCEPT
However, this configuration allows one machine on eth1 to access another machine on eth2, even though I haven't explicitly specified a rule to allow this. How do I isolate these networks, or at most only allow access to certain hosts/ports?