I have a gateway machine connected to multiple internal networks that I would like to set up NAT on. The catch, though, is that these networks need to be isolated from each other, which I haven't been able to figure out. Here's my configuration:

eth0: (upstream), gateway is assigned
eth1: (downstream 1), gateway is assigned
eth2: (downstream 2), gateway is assigned

So far, I've configured iptables to allow on default chains:

iptables -P INPUT ALLOW
iptables -P OUTPUT ALLOW

Then, I've enabled IP forwarding in the kernel and set up iptables:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth2 -o eth0 -j ACCEPT

However, this configuration allows one machine on eth1 to access another machine on eth2, even though I haven't explicitly specified a rule to allow this. How do I isolate these networks, or at most only allow access to certain hosts/ports?

2 Answers 2


You set the policy of the FORWARD chain to ALLOW, so even if nothing in the chain matches, the traffic will be allowed.

You probably should set it to DROP instead.

  • Ok, I modified the FORWARD chain to drop with iptables -P FORWARD DROP. However, this causes NAT connectivity to break since there isn't a rule forwarding eth0 back to eth1 or eth2, so after adding iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT, it seems to work fine. Thanks!
    – user192826
    Commented Oct 6, 2013 at 1:58

As noted in the response to M. Hampton, you have to keep the forwarding feature one for the NAT to work.

As a quick hack, I'd try to block the forwarding in-between the internal subnets, eg. add those commands to yours :

iptables -A FORWARD -i eth1 -o eth2 -j DENY
iptables -A FORWARD -i eth2 -o eth1 -j DENY

That will be messy with 3 internal subnets, as you will have 6 blocking rules, and quite scary for 4 :).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .