Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just installed a wireless access point into my network.

Here is a small diagram:

Internet <===> linux box with iptables <===> LAN

I plugged my wireless access point into the LAN and everything works ok. The network works between all of the devices.

I have a host of static addresses specified using dnsmasq. These addresses are basically x.y.z.1 through x.y.z.199

I have my dhcp server (on the linux box) set to hand out addresses between x.y.z.200 to x.y.z.250

My goal is to allow the LAN devices to talk to LAN devices and the internet. The wireless devices can only talk to the internet. I already have the first part of this working and configured. Just need the incantation for the second part. My wireless devices will be setup through dhcp.

I know a VLAN would be the perfect fit for this, but I don't have any managed switches and stuff. This is just for my home and I am going for cheap.

My hope was to do something like:

iptables -A input -p tcp -s -d -j REJECT
iptables -A input -p udp -s -d -j REJECT

Of course, I can't though because iptables only uses blocks or a single ip. I am not even sure what the syntax would look like to do a block of addresses that fit into the range that I would like.

Thank you in advance!

share|improve this question
up vote 4 down vote accepted

As long as the wired and wireless hosts are in the same subnet, no amount of iptables on the gateway will prevent them from talking amongst themselves.

However, there are a couple of ways you can fake it:

If all the wired hosts have static IPs (or DHCP reserved addresses) but not using dynamic IPs, then you can put a secondary IP in another subnet on the LAN interface on the iptables host. You'll want to turn off redirects (it's a sysctl), and hard-code/use different DHCP options for the wired clients than for the wireless ones. Add an iptables rule to block traffic between the 2 subnets, but permit/masquerade both towards the internet, and you'll be set. However, anyone on wireless who knows it's just a secondary IP can manually configure a LAN-range IP and bypass the block.

If the wireless AP supports VLAN tagging (real enterprise APs do this, and WRT54-likes with OpenWRT/ddwrt/etc can as well), and if your switch passes tagged frames, you can create a vlan sub-interface on the linux machine (again with another subnet, as above). Hosts on the LAN will occasionally receive a tagged frame, and discard it (unless they're running a sniffer), but the AP should (depending on config) ignore the untagged frames it hears from the LAN, so you shouldn't be leaking LAN traffic back to wireless.

Of course, true separation is the best way to go -- managed VLAN-aware switch, or just a 3rd NIC on the Linux host.

share|improve this answer
Very nice explanation thank you. I think the most important take away is this : However, anyone on wireless who knows it's just a secondary IP can manually configure a LAN-range IP and bypass the block. I think for now the 3rd NIC option is the best route. Thank you for the information! – jwendl Dec 4 '11 at 2:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.