How to drop all packets with a source address from the outside matching my internal network?

Question

the part i'm confused is how to use the matching rule in my iptables?

Do i use an if statement?

if [ -i == eth0 ]
then
iptables -A INPUT -j DROP

what am i missing?

How do I know if the source is matched with my internal network eth1?

Answer 1

Ok so first, if you have the same IP address on two different legs of a router, that's bad. Second, if you are trying to filter internet traffic coming in as your local IP you don't really need to worry about that every respectable ISP filters RFC 1918 addresses at their edge. Third if you have the same IP on the same broadcast domain A) that's really bad and B) it'll never hit your firewall.

So, that out of the way. How do you specify an interface in an iptables rule is what I think your asking.

What you do is pass the -i <interface> option.

So for example I want to drop all ICMP echo request traffic coming from the outside I would do something like:

-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j DROP

Where: -A INPUT is the chain I want to append to (-A is for Append) -i eth0 is for interface eth0 (-i is for interface) -p icmp is for the icmp protocol (-p is for protocol) -m icmp is for match icmp (-m is for match) --icmp-type 8 is an echo request -j DROP is to jump to the drop rule

If I wanted to limit this to just one host - say 10.10.10.99 then i would add -d 10.10.10.99/32 to tell it only if the destination is the host 10.10.10.99. and the rule would look like:

-A INPUT -i eth0 -d 10.10.10.99/32 -p icmp -m icmp --icmp-type 8 -j DROP

Answer 2

Something along the lines of the following might work for you:

iptables -A INPUT -s 192.168.7.1 -i eth0 -j DROP

I read it as:

If an input packet is received on the eth0 interface that is sourced as 192.168.7.1, then drop it.