Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have network A (remote) and network B (local).

Network B needs to be able to access network A, but nobody should be able to access network B. How would I go about putting an IPTABLES rule in the router for network B to do this?

share|improve this question
I see that you're still active on ServerFault. To prevent this question from showing up in searches as unanswered, please either provide additional clarity, or accept one of the answers given. If you found a different solution to your problem, provide your own answer and flag it as accepted. Thanks! – Andrew B Jun 16 '13 at 20:07
Thanks- i accepted the answer I used. Completely forgot about this. – Lock Jun 16 '13 at 23:42
up vote 1 down vote accepted

try adding an inbound rule to drop the subnet's traffic:

# iptables -A INPUT -s -j DROP
share|improve this answer
Thanks I'll add it and see how it goes. That will only stop connections initiated from correct? – Lock Mar 14 '13 at 2:41
DANGER: Adding this rule to your INPUT table to your router will drop all traffic from that network, period. – Andrew B Mar 14 '13 at 3:48
I do think that is what the poster is asking for, however. – Stefan Lasiewski Mar 14 '13 at 4:26
1. If you have POLICY DROP in your INPUT chain and this is the last rule, then it's superfluous. 2. This will only drop traffic directed at the router itself, not between two networks; you need the FORWARD chain for that. – SmallClanger Mar 14 '13 at 9:09
3. Even if this was the FORWARD chain and the default policy was ALLOW, this would kill all the reply packets. – Andrew B Mar 14 '13 at 12:35

It's possible to do this with iptables, but you need to be mindful of connection states. You have to allow reply packets from Network A without allowing them to initiate new connections into Network B.

Something like this should do:

iptables -A FORWARD -i eth_netA -o eth_netB -s -d -m state --state=established,related -j ACCEPT
# if your default policy is ALLOW:
iptables -A FORWARD -i eth_netA -o eth_netB -s -d -j DROP
# if your default policy is DROP:
iptables -A FORWARD -i eth_netB -o eth_netA -s -d -j ACCEPT

Note that we're using the FORWARD table here, not INPUT. This is because your machine is routing packets between networks, and you're wanting to catch packets that aren't bound for the router itself. You can leave off the -s and -d statements if you simply want to apply these rules to all traffic being forwarded across those two interfaces.

Be advised that this relies upon the connection tracking features of iptables (which is already loaded if you have any -t nat rules), and you may need to do some tuning of ip_conntrack parameters if you're sending a heavy load of packets back and forth. The most common warning sign is the table full, dropping packet message in syslog.

share|improve this answer
+1 the important part is the "--state=established,related" in the first rule. This lets replies from network A through, but doesn't let net A start a new connection. – Grant Mar 14 '13 at 12:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.