2

I use ubuntu as gateway for several hosts. I need advise how to block ip forwarding for specific ip address or specific ip range?

I tried to block ip via ufw deny rules, but it looks like ip forwarding settings cannot be modified via rules and it can be applied only globally (DEFAULT_FORWARD_POLICY in /etc/default/ufw)

Also i tried to change iptables rules directly:

iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited 

After this command ip forwarding reject rule blocks forwarding requests from all of remote hosts.

Update: current iptable output:

root@mtu90:/home/pi# iptables -L -n -v
Chain INPUT (policy ACCEPT 5671 packets, 927K bytes)
 pkts bytes target     prot opt in     out     source               destination 
    0     0 DROP       all  --  *      *       0.0.0.0/0            172.16.1.77 
  192 15408 DROP       all  --  *      *       172.16.1.77          0.0.0.0/0   

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 
  895  136K            all  --  *      *       0.0.0.0/0            0.0.0.0/0   
  518 30999 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 119 packets, 14872 bytes)
 pkts bytes target     prot opt in     out     source               destination 
  • It can certainly be modified by iptables rules. If you're open to changing them, could you cut-and-paste the output of iptables -L -n -v into your question? (It may be possible to do it via ufw also, I just don't know ufw.) – MadHatter May 4 '14 at 17:51
  • please take a look. i've just updated my question with iptables output – user277820 May 4 '14 at 18:00
3

I think you are overthinking the problem. It is trivial to block forwarding requests using iptables on whatever basis you like.

There is, of-course, a default setting - forwarding can be allowed or denied by default - Your current setting is allowed. Thus to drop a specific host, simply add an iptables rule

iptables -I FORWARD -d sou.rce.ip.add -j DROP

Make sure that you remember to remove your rule to REJECT everything in the forward chain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.