Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two routers.

A - is connected to the internet

B - is connected to A router's network

A has some clients (notebooks, computers, printers, etc.).

B has also some clients.

B clients are not allowed to see the clients inside A router's network but should be able to use A network to access the internet.

I am new at routing, networking etc. - how can I tell router B to communicate only with router A and don't show the A network clients?

Router B has DD-WRT installed.

More informations about the networks:

Network A: - router IP (static): - DHCP enabled / Linksys WRT54GL (original firmware) Network B: - router IP (static): - DHCP enabled / TP-Link WR1043ND (with DD-WRT v24)

share|improve this question

closed as off-topic by Dave M, Falcon Momot, dawud, Scott Pack, Ward Sep 22 '13 at 15:21

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – Dave M, Falcon Momot, dawud, Scott Pack, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

I know at least 3 solutions, but you need to give more details about e.g. the actual addressing. The easiest would be to statically configure B to add a /32 route to A and set it as default gateway, but this is not 100% fullproof if A routes blindly. – BatchyX Sep 21 '13 at 17:07
@BatchyX I added more informations to my question. – Mike Sep 21 '13 at 17:15

If router B is in NAT mode, you should be able to get by with just a couple firewall rules like so:

iptables -A FORWARD -s 192,168.2.0/24 -d -j ACCEPT
iptables -A FORWARD -d -j DROP

Where to put them in your firewall config depends on what rules you already have. You want them before the other ACCEPT rules except for any RELATED,ESTABLISHED-style conntrack rules.

share|improve this answer
The solution is (tested and working): Install on the ROUTER inside the green network the newest DD-WRT version. After installing DD-WRT go into the Web-Admin-GUI of the green network router, to add ONE command line. Inside the Web-Admin-GUI goto: "Administration" --> "Commands" and add this line: iptables -I FORWARD -d -j DROP ( is the network number of the orange network) IMPORTANT: that the router don't forget this line at reboot - save it with the button "Save Firewall". – Mike Sep 21 '13 at 22:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.