How to block packets whoes dst or src ip is not in a subnet?

Question

I need to block some packets in ppp0, and the target ip or source ip of packets are not in

172.17.0.1/24, how to add rules in Iptables? thanks!

Answer 1

i'm not sure if this is what you really want but this is what you are describing:

iptables -N ppp0traffic
iptables -A ppp0traffic -s 172.17.0.0/24 -j ACCEPT
iptables -A ppp0traffic -d 172.17.0.0/24 -j ACCEPT
iptables -A ppp0traffic -j DROP

iptables -A FORWARD -i ppp0 -j ppp0traffic
iptables -A FORWARD -o ppp0 -j ppp0traffic

Answer 2

That would have been -A INPUT too.

But if you do not have a route to 172.17.0.0/24 (check with ip route show table all), then these packets get automatically dropped; no need for rules.