up vote 1 down vote favorite
1
share [g+] share [fb]

I have two inerfaces on my router with tomato firmwre: br0 and vlan4. br0 is on 192.168.0.0/16 subnet and vlan4 on 10.0.1.0/24 subnet. As I don't want the different network services on br0 available on vlan4, I have added this firewall rule:

iptables -I INPUT -i vlan4 -j ACCEPT;
iptables -I FORWARD -i vlan4 -o vlan2 -m state --state NEW -j ACCEPT;
iptables -I FORWARD -i br0 -o vlan4 -j DROP;

vlan2 is my WAN (internet acess).

The issue that I want to solve is that I want to make one host from 192.168.0.0/16 network (br0), which has ip 192.168.0.50, available on vlan4 (10.0.1.0/24). Only that host should be available on vlan4 (and all other hosts on br0 should be inaccessible). What firewall rules can be used to do it?

Edit 1:

Output of iptables -nvL FORWARD:

Chain FORWARD (policy DROP 4 packets, 204 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  vlan4  192.168.0.50  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  vlan4  ppp0    0.0.0.0/0            0.0.0.0/0           state NEW 
  229 13483 ACCEPT     all  --  vlan4  vlan2   0.0.0.0/0            0.0.0.0/0           state NEW 
    0     0 DROP       all  --  br0    vlan3   0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  vlan3  ppp0    0.0.0.0/0            0.0.0.0/0           state NEW 
   67  3405 ACCEPT     all  --  vlan3  vlan2   0.0.0.0/0            0.0.0.0/0           state NEW    
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0           
   34  1360 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
  758 40580 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 TCPMSS clamp to PMTU 
11781 2111K restrict   all  --  *      vlan2   0.0.0.0/0            0.0.0.0/0           
26837   19M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 wanin      all  --  vlan2  *       0.0.0.0/0            0.0.0.0/0           
  287 15927 wanout     all  --  *      vlan2   0.0.0.0/0            0.0.0.0/0           
  283 15723 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
    0     0 upnp       all  --  vlan2  *       0.0.0.0/0            0.0.0.0/0

Output of iptables -t nat -nvL PREROUTING:

Chain PREROUTING (policy ACCEPT 6887 packets, 526K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  855 83626 WANPREROUTING  all  --  *      *       0.0.0.0/0            222.228.137.210     
    0     0 DROP       all  --  vlan2  *       0.0.0.0/0            192.168.0.0/16      
    0     0 DNAT       udp  --  *      *       192.168.0.0/16      !192.168.0.0/16      udp dpt:53 to:192.168.0.1

The output of ip route show:

222.228.137.209 dev vlan2  scope link
222.228.137.208/29 dev vlan2  proto kernel  scope link  src 222.228.137.210
10.0.0.0/24 dev vlan3  proto kernel  scope link  src 10.0.0.1
10.0.1.0/24 dev vlan4  proto kernel  scope link  src 10.0.1.1
192.168.1.0/24 dev br0  proto kernel  scope link  src 192.168.1.252
192.168.0.0/16 dev br0  proto kernel  scope link  src 192.168.0.1
127.0.0.0/8 dev lo  scope link
default via 222.228.137.209 dev vlan2
link|improve this question
69% accept rate
Are there routes for the subnets already set up? – toor Feb 9 '11 at 3:53
yes they are. Right now they are isolated from each other, but they are connected to WAN via same public ip. – nixnotwin Feb 9 '11 at 6:28
feedback

3 Answers

up vote 1 down vote accepted

iptables -I FORWARD -i vlan4 -d 192.168.0.50 -j ACCEPT

Put it before your last rule in your original question.

I assume you have done something like this as well:

echo 1 > /proc/sys/net/ipv4/ip_forward

to enable forwarding in general on your system.

link|improve this answer
Wow. It worked. Thanks. – nixnotwin Feb 17 '11 at 4:51
feedback
up vote 1 down vote

All you need to do is add

iptables -I FORWARD -s 192.168.0.50 -o vlan4 -j ACCEPT

before that 3rd rule you listed (the drop)

link|improve this answer
Didn't work. I tried to access a webpage which runs on 192.168.0.50. I typed 192.168.0.50 in my browser from a pc which has 10.0.1.10 ip (the pc is on vlan4 network). There was no response, and 192.168.0.50 host didn't reply to ping requests. – nixnotwin Feb 9 '11 at 7:49
Should I also add static route? – nixnotwin Feb 9 '11 at 13:36
As long as your router has a route to both subnets, then it should work. Can you paste complete iptables -nvL FORWARD along with iptables -t nat -nvL PREROUTING ? – Patrick Feb 10 '11 at 0:25
feedback
up vote 1 down vote

iptables -I FORWARD 1 -m state --state ESTABLISHED,RELATED -j ACCEPT

link|improve this answer
As I want to make only 192.168.0.50 accessible on 10.0.1.0/24 network, how to mention its ip in the iptables rule that you've stated in your answer? – nixnotwin Feb 11 '11 at 16:36
Since this "ESTALBLISHED,RELATED" relates only to those connections that were accepted in NEW state, you have to modify or add NEW rule accordingly. – poige Feb 11 '11 at 17:24
I think poige's answer is to be used in unison with Patrick's. One handles the subnet initiating the connection, and the RELATED rule allows answer-packets back through. – Ricardo Pardini Feb 12 '11 at 0:22
I tried it but it didn't work. I also tried turning off firewall itself, the host was not reachable then too. – nixnotwin Feb 12 '11 at 5:25
Well, so you probably haven't correspondig routes (an obvious thing to do). – poige Feb 12 '11 at 5:42
show 6 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.