I currently have a router attached to the main network (192.168.0.x). On this router, I want the ethernet-ports to link to the main network, and the vlan's (wireless) to be set up via a separate DHCP server on its own subnet (192.168.1.x). This works just fine right now.
The problem I'm having is that I want to block access from the vlans to other clients on the same subnet (so block 192.168.0.x traffic to 192.168.0.x) and also block all traffic to the main network subnet (albeit allowing DNS queries).
I figured I would need some iptables rules:
# allow DNS iptables -I INPUT -i br0 -p udp --dport 53 -j ACCEPT iptables -I INPUT -i br0 -p tcp --dport 53 -j ACCEPT iptables -I OUTPUT -p udp --dport 53 -j ACCEPT iptables -I OUTPUT -p tcp --dport 53 -j ACCEPT # deny access to the 192.168.x.x hosts from internal vlan-users iptables -A OUTPUT -s 192.168.1.0/255.255.255.0 -d 192.168.0.0/255.255.255.0 -j DROP iptables -A FORWARD -d 192.168.0.0/255.255.255.0 -m state --state NEW -j DROP iptables -I INPUT -d 192.168.0.0/255.255.255.0 -m state --state NEW -j DROP
However, when testing this, I was still able to connect to clients on 192.168.0.x and 192.168.1.x
What am I missing? Am I perhaps trying it on the wrong chains (or perhaps table)?