I have a router/gateway that is 10.1.1.1/24 I have a server running Ubunutu server 16.04 with 3 interfaces. ens3 = 10.1.1.250/24 (outside) ens4 = 10.1.2.250/24 (inside) ens5 = 10.1.3.250/24 (not used yet) I added one nat table rule to SNAT the ens3 outside interface.
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 SNAT all -- any ens3 anywhere anywhere to:10.1.1.250
using a laptop I set my default gateway to 10.1.2.250 and ip to 10.1.2.22/24 and I am able to ping all server interfaces, the router and out to the internet.
I added a filter rule to drop based on destination ip
Chain OUTPUT (policy ACCEPT 23 packets, 2564 bytes) pkts bytes target prot opt in out source destination 0 0 DROP all -- any any anywhere 220.127.116.11
from the server trying to go to that IP, the rule blocks my connection and records count properly, but from my laptop connecting at ens4 I can make it to the site and it does not get blocked.
What am I missing?