Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server with 2 interfaces. a small netework connects to eth0 and gets out to internet on eth1. To allow 1 ip to nat I use

iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.23 -j SNAT --to-source=23.x.x.x

I would like to add a rule that allow a single ip do nat and block the others already existing in iptables(without deleting them)

iptables -t nat -A POSTROUTING -o OUT_IF \! -s ip_sursa -j SNAT --to-source=x3.xxx.1xx.1xx -j DROP

would work?

Or, to allow only 1 ip to pass over eth0 to eth1 and do nat.

share|improve this question

1 Answer 1

It is not recommended to use DROP in the NAT table. It is better to do this the filter table if you want to deny the access to these IP addresses.

Otherwise, you can use a different rule to NAT these IPs to a different public IP.

Update

Here are the rules you need to allow only one IP (192.168.0.100)

iptables -A FORWARD -o eth1 -s 192.168.0.100 -j ACCEPT
iptables -A FORWARD -o eth1 -s 192.168.0.0/24 -j DROP
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.100 -j SNAT --to-source=23.x.x.x
share|improve this answer
    
so...how can I do it? How to allow only 1 ip pass from eth0 to eth1? –  Linux_begnr Jul 16 '11 at 11:53
    
You can use iptables -A FORWARD -o OUT_IF -s IP_range -j DROP. –  Khaled Jul 16 '11 at 14:35
    
the ip i want to allow is 192.168.0.100. I want to block all the others.How to give the range from 0-99 and 101-254(with 192.168.0.0/24 i will block all class). can i give IP_range=192.168.0.1-192.168.0.99 and 192.168.0.101-192.168.0.254 and make 2 rules? –  Linux_begnr Jul 16 '11 at 16:43
    
"iptables -A FORWARD -o OUT_IF -s IP_range -j DROP" without "-t nat"?I need nat –  Linux_begnr Jul 16 '11 at 17:37
    
iptables -A FORWARD -o OUT_IF -m iprange --src-range 192.168.1.0-192.168.1.99 -j DROP and iptables -A FORWARD -o OUT_IF -m iprange --src-range 192.168.1.101-192.168.1.254 -j DROP would work? –  Linux_begnr Jul 17 '11 at 10:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.