Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

the part i'm confused is how to use the matching rule in my iptables?

Do i use an if statement?

if [ -i == eth0 ]
then
iptables -A INPUT -j DROP

what am i missing?

How do I know if the source is matched with my internal network eth1?

share|improve this question
    
This question is confusing. Can you try to clarify what you want to stop? –  Nathan Powell Feb 11 '11 at 2:46
    
if my ip is 192.168.7.1 then if any other outside IP is also 192.168.7.1, it should be dropped. I think this is my question. –  Snow Feb 11 '11 at 3:35

2 Answers 2

up vote 2 down vote accepted

Ok so first, if you have the same IP address on two different legs of a router, that's bad. Second, if you are trying to filter internet traffic coming in as your local IP you don't really need to worry about that every respectable ISP filters RFC 1918 addresses at their edge. Third if you have the same IP on the same broadcast domain A) that's really bad and B) it'll never hit your firewall.

So, that out of the way. How do you specify an interface in an iptables rule is what I think your asking.

What you do is pass the -i <interface> option.

So for example I want to drop all ICMP echo request traffic coming from the outside I would do something like:

-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j DROP

Where: -A INPUT is the chain I want to append to (-A is for Append) -i eth0 is for interface eth0 (-i is for interface) -p icmp is for the icmp protocol (-p is for protocol) -m icmp is for match icmp (-m is for match) --icmp-type 8 is an echo request -j DROP is to jump to the drop rule

If I wanted to limit this to just one host - say 10.10.10.99 then i would add -d 10.10.10.99/32 to tell it only if the destination is the host 10.10.10.99. and the rule would look like:

-A INPUT -i eth0 -d 10.10.10.99/32 -p icmp -m icmp --icmp-type 8 -j DROP

share|improve this answer

Something along the lines of the following might work for you:

iptables -A INPUT -s 192.168.7.1 -i eth0 -j DROP

I read it as:

If an input packet is received on the eth0 interface that is sourced as 192.168.7.1, then drop it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.