Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two inerfaces on my router with tomato firmwre: br0 and vlan4. br0 is on 192.168.0.0/16 subnet and vlan4 on 10.0.1.0/24 subnet. As I don't want the different network services on br0 available on vlan4, I have added this firewall rule:

iptables -I INPUT -i vlan4 -j ACCEPT;
iptables -I FORWARD -i vlan4 -o vlan2 -m state --state NEW -j ACCEPT;
iptables -I FORWARD -i br0 -o vlan4 -j DROP;

vlan2 is my WAN (internet acess).

The issue that I want to solve is that I want to make one host from 192.168.0.0/16 network (br0), which has ip 192.168.0.50, available on vlan4 (10.0.1.0/24). Only that host should be available on vlan4 (and all other hosts on br0 should be inaccessible). What firewall rules can be used to do it?

Edit 1:

Output of iptables -nvL FORWARD:

Chain FORWARD (policy DROP 4 packets, 204 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  vlan4  192.168.0.50  0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  vlan4  ppp0    0.0.0.0/0            0.0.0.0/0           state NEW 
  229 13483 ACCEPT     all  --  vlan4  vlan2   0.0.0.0/0            0.0.0.0/0           state NEW 
    0     0 DROP       all  --  br0    vlan3   0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  vlan3  ppp0    0.0.0.0/0            0.0.0.0/0           state NEW 
   67  3405 ACCEPT     all  --  vlan3  vlan2   0.0.0.0/0            0.0.0.0/0           state NEW    
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0           
   34  1360 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
  758 40580 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 TCPMSS clamp to PMTU 
11781 2111K restrict   all  --  *      vlan2   0.0.0.0/0            0.0.0.0/0           
26837   19M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 wanin      all  --  vlan2  *       0.0.0.0/0            0.0.0.0/0           
  287 15927 wanout     all  --  *      vlan2   0.0.0.0/0            0.0.0.0/0           
  283 15723 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
    0     0 upnp       all  --  vlan2  *       0.0.0.0/0            0.0.0.0/0  

Output of iptables -t nat -nvL PREROUTING:

Chain PREROUTING (policy ACCEPT 6887 packets, 526K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  855 83626 WANPREROUTING  all  --  *      *       0.0.0.0/0            222.228.137.210     
    0     0 DROP       all  --  vlan2  *       0.0.0.0/0            192.168.0.0/16      
    0     0 DNAT       udp  --  *      *       192.168.0.0/16      !192.168.0.0/16      udp dpt:53 to:192.168.0.1 

The output of ip route show:

222.228.137.209 dev vlan2  scope link
222.228.137.208/29 dev vlan2  proto kernel  scope link  src 222.228.137.210
10.0.0.0/24 dev vlan3  proto kernel  scope link  src 10.0.0.1
10.0.1.0/24 dev vlan4  proto kernel  scope link  src 10.0.1.1
192.168.1.0/24 dev br0  proto kernel  scope link  src 192.168.1.252
192.168.0.0/16 dev br0  proto kernel  scope link  src 192.168.0.1
127.0.0.0/8 dev lo  scope link
default via 222.228.137.209 dev vlan2
share|improve this question
    
Are there routes for the subnets already set up? –  d-_-b Feb 9 '11 at 3:53
    
yes they are. Right now they are isolated from each other, but they are connected to WAN via same public ip. –  nixnotwin Feb 9 '11 at 6:28

3 Answers 3

up vote 1 down vote accepted

iptables -I FORWARD -i vlan4 -d 192.168.0.50 -j ACCEPT

Put it before your last rule in your original question.

I assume you have done something like this as well:

echo 1 > /proc/sys/net/ipv4/ip_forward

to enable forwarding in general on your system.

share|improve this answer
    
Wow. It worked. Thanks. –  nixnotwin Feb 17 '11 at 4:51

All you need to do is add

iptables -I FORWARD -s 192.168.0.50 -o vlan4 -j ACCEPT

before that 3rd rule you listed (the drop)

share|improve this answer
    
Didn't work. I tried to access a webpage which runs on 192.168.0.50. I typed 192.168.0.50 in my browser from a pc which has 10.0.1.10 ip (the pc is on vlan4 network). There was no response, and 192.168.0.50 host didn't reply to ping requests. –  nixnotwin Feb 9 '11 at 7:49
    
Should I also add static route? –  nixnotwin Feb 9 '11 at 13:36
    
As long as your router has a route to both subnets, then it should work. Can you paste complete iptables -nvL FORWARD along with iptables -t nat -nvL PREROUTING ? –  Patrick Feb 10 '11 at 0:25

iptables -I FORWARD 1 -m state --state ESTABLISHED,RELATED -j ACCEPT

share|improve this answer
    
As I want to make only 192.168.0.50 accessible on 10.0.1.0/24 network, how to mention its ip in the iptables rule that you've stated in your answer? –  nixnotwin Feb 11 '11 at 16:36
    
Since this "ESTALBLISHED,RELATED" relates only to those connections that were accepted in NEW state, you have to modify or add NEW rule accordingly. –  poige Feb 11 '11 at 17:24
    
I think poige's answer is to be used in unison with Patrick's. One handles the subnet initiating the connection, and the RELATED rule allows answer-packets back through. –  Ricardo Pardini Feb 12 '11 at 0:22
    
I tried it but it didn't work. I also tried turning off firewall itself, the host was not reachable then too. –  nixnotwin Feb 12 '11 at 5:25
    
Well, so you probably haven't correspondig routes (an obvious thing to do). –  poige Feb 12 '11 at 5:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.