Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

simply put, i want to use these rules:

iptables -I FORWARD -i br0.105 -d 192.168.0.0/16 -j DROP
iptables -I FORWARD -s 192.168.0.0/16 -i br0.105 -j DROP

but with the exception of the 192.168.99.0/24 subnet.

Is there a way of specifying this in the lines above? I prefer ta not add an exception-rule with -j accept for the .99-subnet, as there are other rules that refer to that particular subnet.

share|improve this question

3 Answers 3

as there are other rules that apply as well

What are other rules? It apply for .99 subnet or It apply for 192.168.0.0/16?

If It just apply for .99 subnet, you only have to move It up, above these two rules.

share|improve this answer

Use a new chain. There are multiple ways to do this, my preference would be this:

iptables -N DROP_BAD_HOSTS
iptables -A DROP_BAD_HOSTS -s 192.168.99.0/24 -j RETURN
iptables -A DROP_BAD_HOSTS -i br0.105 -d 192.168.0.0/16 -j DROP
iptables -A DROP_BAD_HOSTS -s 192.168.0.0/16 -i br0.105 -j DROP
iptables -A FORWARD -j DROP_BAD_HOSTS

Notice the first rule does a RETURN if the source is the /24 you want to exclude.

Another method is this, but is less flexible in that you can't add another range to exclude in the future:

iptables -N DROP_BAD_HOSTS
iptables -A DROP_BAD_HOSTS -i br0.105 -d 192.168.0.0/16 -j DROP
iptables -A DROP_BAD_HOSTS -s 192.168.0.0/16 -i br0.105 -j DROP
iptables -A FORWARD ! -s 192.168.99.0/24 -j DROP_BAD_HOSTS
share|improve this answer

Create a new chain:

iptables -N subnet1

Direct the exception network to the new chain:

iptables -I FORWARD -i br0.105 -d 192.168.99.0/24 -j subnet1

Apply other rules to traffic in that chain:

iptables -I subnet1 ... -j DROP/ACCEPT
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.