I have a small VPN setup where I use IP tables to nat traffic coming in the vpn0 interface to the IP address of the eth0 interface. These rules look like this:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i vpn0 -j ACCEPT

The device that has this configuration gets plugged into many different network subnets and its IP address is usually obtained dynamically. I run a lot of host discovery scans using nmap accross this connection and would like to drop traffic coming in on the vpn0 interface that is destined for whichever IP address is configured on the eth0 interface to keep my results accurate without having to worry about manually omitting the vpn host. Since this device is routing traffic, I can't just use the destination interface as the destination as this would block all my forward traffic.

I know iptables supports hostnames as destinations, so I may end up trying to dynamically add a rule once the IP address is obtained and create a hostname that will resolve to the eth0 IP address. However, this seems pretty messy.

Is there a better way that I'm missing?


The solution I used was not as elegant as was hoping, but simple none-the-less.

All I did was get the IP address from the eth0 interface and assign it to a variable and then use that variable in an iptables rule:

ETH0IP=`/sbin/ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}'`
iptables -I INPUT -i vpn0 -d $ETH0IP -j DROP

Additionally, my question betrays the fact that I did not understand the FORWARD table as this is NOT the tables used for traffic destined for a local interface. The rule should be implemented in the INPUT table.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.