Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using the entire subnet on the private side.

I want to allow a certain section of the subnet (say - to access the internet via linux router but not the rest of the network( -

I have tried iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE is - but with that none of the workstations can access the net

I know the entire is 16,777,214 ip addresses but I have my reasons


share|improve this question
Your problem description is not helpful for two reasons. First, you only show a portion of the iptables rule that didn't work. Second, you don't tell us exactly what went wrong when you tried it, just that it didn't work. – David Schwartz May 29 '13 at 7:16
Can you give us the full iptables rule(s) you are using? iptables -t nat -A POSTROUTING -s is incomplete. – Zoredache May 29 '13 at 7:16
the full rule was: iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE as for not working all i can elaborate on is the workstations no longer could access the internet – BrierMay May 29 '13 at 7:24
Is eth0 the WAN-facing interface? – Michael Hampton May 29 '13 at 7:25
yes eth0 is wan eth1 is lan – BrierMay May 29 '13 at 7:26
up vote 1 down vote accepted

I figured it out via this question How to allow a range of IP's with IPTABLES?


iptables -t nat -A POSTROUTING -m iprange --src-range (start ip)-(end ip) -o eth0 -j MASQUERADE

example: iptables -t nat -A POSTROUTING -m iprange --src-range -o eth0 -j MASQUERADE

share|improve this answer

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more.

You can write ACL in squid and allow/disallow on the basis of your requirement.

share|improve this answer
I am not against squid, but it isn't a NAT tool. If he needs to use applications that cannot operate via a HTTP/TCP proxy, then squid will not be the answer he needs. His question was about iptables, and what he wants should be trivial, but he hasn't povided enough information. – Zoredache May 29 '13 at 7:18
I need full nat – BrierMay May 29 '13 at 7:28
and I'm a she not a he :) – BrierMay May 29 '13 at 7:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.