iptables rule to break a route

Question

I just installed a wireless access point into my network.

Here is a small diagram:

Internet <===> linux box with iptables <===> LAN

I plugged my wireless access point into the LAN and everything works ok. The network works between all of the devices.

I have a host of static addresses specified using dnsmasq. These addresses are basically x.y.z.1 through x.y.z.199

I have my dhcp server (on the linux box) set to hand out addresses between x.y.z.200 to x.y.z.250

My goal is to allow the LAN devices to talk to LAN devices and the internet. The wireless devices can only talk to the internet. I already have the first part of this working and configured. Just need the incantation for the second part. My wireless devices will be setup through dhcp.

I know a VLAN would be the perfect fit for this, but I don't have any managed switches and stuff. This is just for my home and I am going for cheap.

My hope was to do something like:

iptables -A input -p tcp -s 192.168.1.200:192.168.1.250 -d 192.168.1.1:192.168.1.199 -j REJECT
iptables -A input -p udp -s 192.168.1.200:192.168.1.250 -d 192.168.1.1:192.168.1.199 -j REJECT

Of course, I can't though because iptables only uses blocks or a single ip. I am not even sure what the syntax would look like to do a block of addresses that fit into the range that I would like.

Thank you in advance!

Answer 1

As long as the wired and wireless hosts are in the same subnet, no amount of iptables on the gateway will prevent them from talking amongst themselves.

However, there are a couple of ways you can fake it:

If all the wired hosts have static IPs (or DHCP reserved addresses) but not using dynamic IPs, then you can put a secondary IP in another subnet on the LAN interface on the iptables host. You'll want to turn off redirects (it's a sysctl), and hard-code/use different DHCP options for the wired clients than for the wireless ones. Add an iptables rule to block traffic between the 2 subnets, but permit/masquerade both towards the internet, and you'll be set. However, anyone on wireless who knows it's just a secondary IP can manually configure a LAN-range IP and bypass the block.

If the wireless AP supports VLAN tagging (real enterprise APs do this, and WRT54-likes with OpenWRT/ddwrt/etc can as well), and if your switch passes tagged frames, you can create a vlan sub-interface on the linux machine (again with another subnet, as above). Hosts on the LAN will occasionally receive a tagged frame, and discard it (unless they're running a sniffer), but the AP should (depending on config) ignore the untagged frames it hears from the LAN, so you shouldn't be leaking LAN traffic back to wireless.

Of course, true separation is the best way to go -- managed VLAN-aware switch, or just a 3rd NIC on the Linux host.