Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using the entire 10.0.0.0/8 subnet on the private side.

I want to allow a certain section of the subnet (say 10.0.0.2 - 10.0.31.254) to access the internet via linux router but not the rest of the network(10.0.32.1 - 10.255.255.254)

I have tried iptables -t nat -A POSTROUTING -s 10.0.0.0/19 -o eth0 -j MASQUERADE 10.0.0.0/19 is 10.0.0.2 - 10.0.31.254 but with that none of the workstations can access the net

I know the entire 10.0.0.0/8 is 16,777,214 ip addresses but I have my reasons

Thankyou

share|improve this question
2  
Your problem description is not helpful for two reasons. First, you only show a portion of the iptables rule that didn't work. Second, you don't tell us exactly what went wrong when you tried it, just that it didn't work. –  David Schwartz May 29 '13 at 7:16
2  
Can you give us the full iptables rule(s) you are using? iptables -t nat -A POSTROUTING -s 10.0.0.0/19 is incomplete. –  Zoredache May 29 '13 at 7:16
    
the full rule was: iptables -t nat -A POSTROUTING -s 10.0.0.0/19 -o eth0 -j MASQUERADE as for not working all i can elaborate on is the workstations no longer could access the internet –  BrierMay May 29 '13 at 7:24
    
Is eth0 the WAN-facing interface? –  Michael Hampton May 29 '13 at 7:25
    
yes eth0 is wan eth1 is lan –  BrierMay May 29 '13 at 7:26

2 Answers 2

up vote 0 down vote accepted

I figured it out via this question How to allow a range of IP's with IPTABLES?

its:

iptables -t nat -A POSTROUTING -m iprange --src-range (start ip)-(end ip) -o eth0 -j MASQUERADE

example: iptables -t nat -A POSTROUTING -m iprange --src-range 10.0.0.2-10.0.31.255 -o eth0 -j MASQUERADE

share|improve this answer

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more.

  http://www.squid-cache.org/

You can write ACL in squid and allow/disallow on the basis of your requirement.

share|improve this answer
    
I am not against squid, but it isn't a NAT tool. If he needs to use applications that cannot operate via a HTTP/TCP proxy, then squid will not be the answer he needs. His question was about iptables, and what he wants should be trivial, but he hasn't povided enough information. –  Zoredache May 29 '13 at 7:18
    
I need full nat –  BrierMay May 29 '13 at 7:28
    
and I'm a she not a he :) –  BrierMay May 29 '13 at 7:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.