4

Let's say I have two interfaces on one host, eth0 and eth1. The behavior I'm seeing currently is:

Receive traffic on eth0, it finds a suitable route on eth1 and tries to send it.

I'm already intercepting the packets coming in on eth0 so I would like to stop this forwarding and drop all packets coming in on eth0 instead of sending them on eth1.

In essence, I'd like to block all traffic between two interfaces on one host. Is this possible with iptables or routing?

Improve this question

2 Answers 2

Reset to default
4

iptables -A FORWARD -i eth0 -o eth1 -j DROP should do what you’re requesting.

Improve this answer
7

You should be able to control this at the kernel level with sysctl. Setting the net.ipv4 and/or net.ipv6 forwarding values off.

net.ipv4.conf.all.forwarding = 0
net.ipv4.conf.eth0.forwarding = 0
net.ipv4.conf.eth1.forwarding = 0

Depending on the distribution you can configure this at startup by editing /etc/sysctl.conf or adding a file in /etc/sysctl.d. Normally forwarding is disabled by default, so you may have a line enabling forwarding.

Some firewall builders will enable or disable forwarding depending on the configuration.

Improve this answer
1
  • 1
    let's say, you want to block traffic from eth0 to eth2, but you want to allow traffic from eth0 to eth1. This approach doesn't work.
    – maxadamo
    Mar 19, 2023 at 21:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .