Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two inerfaces on my router with tomato firmwre: br0 and vlan4. br0 is on subnet and vlan4 on subnet. As I don't want the different network services on br0 available on vlan4, I have added this firewall rule:

iptables -I INPUT -i vlan4 -j ACCEPT;
iptables -I FORWARD -i vlan4 -o vlan2 -m state --state NEW -j ACCEPT;
iptables -I FORWARD -i br0 -o vlan4 -j DROP;

vlan2 is my WAN (internet acess).

The issue that I want to solve is that I want to make one host from network (br0), which has ip, available on vlan4 ( Only that host should be available on vlan4 (and all other hosts on br0 should be inaccessible). What firewall rules can be used to do it?

Edit 1:

Output of iptables -nvL FORWARD:

Chain FORWARD (policy DROP 4 packets, 204 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  vlan4             
    0     0 ACCEPT     all  --  vlan4  ppp0             state NEW 
  229 13483 ACCEPT     all  --  vlan4  vlan2             state NEW 
    0     0 DROP       all  --  br0    vlan3             
    0     0 ACCEPT     all  --  vlan3  ppp0             state NEW 
   67  3405 ACCEPT     all  --  vlan3  vlan2             state NEW    
    0     0 ACCEPT     all  --  br0    br0             
   34  1360 DROP       all  --  *      *             state INVALID 
  758 40580 TCPMSS     tcp  --  *      *             tcp flags:0x06/0x02 TCPMSS clamp to PMTU 
11781 2111K restrict   all  --  *      vlan2             
26837   19M ACCEPT     all  --  *      *             state RELATED,ESTABLISHED 
    0     0 wanin      all  --  vlan2  *             
  287 15927 wanout     all  --  *      vlan2             
  283 15723 ACCEPT     all  --  br0    *             
    0     0 upnp       all  --  vlan2  *    

Output of iptables -t nat -nvL PREROUTING:

Chain PREROUTING (policy ACCEPT 6887 packets, 526K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  855 83626 WANPREROUTING  all  --  *      *       
    0     0 DROP       all  --  vlan2  *        
    0     0 DNAT       udp  --  *      *      !      udp dpt:53 to: 

The output of ip route show: dev vlan2  scope link dev vlan2  proto kernel  scope link  src dev vlan3  proto kernel  scope link  src dev vlan4  proto kernel  scope link  src dev br0  proto kernel  scope link  src dev br0  proto kernel  scope link  src dev lo  scope link
default via dev vlan2
share|improve this question
Are there routes for the subnets already set up? – d-_-b Feb 9 '11 at 3:53
yes they are. Right now they are isolated from each other, but they are connected to WAN via same public ip. – nixnotwin Feb 9 '11 at 6:28

3 Answers 3

up vote 1 down vote accepted

iptables -I FORWARD -i vlan4 -d -j ACCEPT

Put it before your last rule in your original question.

I assume you have done something like this as well:

echo 1 > /proc/sys/net/ipv4/ip_forward

to enable forwarding in general on your system.

share|improve this answer
Wow. It worked. Thanks. – nixnotwin Feb 17 '11 at 4:51

All you need to do is add

iptables -I FORWARD -s -o vlan4 -j ACCEPT

before that 3rd rule you listed (the drop)

share|improve this answer
Didn't work. I tried to access a webpage which runs on I typed in my browser from a pc which has ip (the pc is on vlan4 network). There was no response, and host didn't reply to ping requests. – nixnotwin Feb 9 '11 at 7:49
Should I also add static route? – nixnotwin Feb 9 '11 at 13:36
As long as your router has a route to both subnets, then it should work. Can you paste complete iptables -nvL FORWARD along with iptables -t nat -nvL PREROUTING ? – Patrick Feb 10 '11 at 0:25

iptables -I FORWARD 1 -m state --state ESTABLISHED,RELATED -j ACCEPT

share|improve this answer
As I want to make only accessible on network, how to mention its ip in the iptables rule that you've stated in your answer? – nixnotwin Feb 11 '11 at 16:36
Since this "ESTALBLISHED,RELATED" relates only to those connections that were accepted in NEW state, you have to modify or add NEW rule accordingly. – poige Feb 11 '11 at 17:24
I think poige's answer is to be used in unison with Patrick's. One handles the subnet initiating the connection, and the RELATED rule allows answer-packets back through. – Ricardo Pardini Feb 12 '11 at 0:22
I tried it but it didn't work. I also tried turning off firewall itself, the host was not reachable then too. – nixnotwin Feb 12 '11 at 5:25
Well, so you probably haven't correspondig routes (an obvious thing to do). – poige Feb 12 '11 at 5:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.