On my server, I have a default route to interface
eth0. It has public internet address and faces ISP network. I have packet forwarding enabled, and few local interfaces/bridges with private
10.x.x.x addresses. Also, all packages that are outgoing to ISP network is masqueraded. The problem: if I understand correctly, any packet to non-existent
192.168.x.x address will be forwarded through public server interface (uplink) to my ISP. That is not desired.
How can I configure linux to prevent forwarding any packets with private network address destination through a public network interface? I guess just adding a single iptables rule would not be enough because there are multiple standard private network spaces (10.x.x.x, 192.16.x.x, 172.16.x.x and maybe others. Also ipv6 addresses aside). Is there any iptables plugin/system policy to accomplish that? I'd expect some system policy to mark the interface as uplink that faces internet.
Reasoning: my ISP does not like any packages with private network range destinations. I'm using a DNS server that is accessed through VPN to my work. So when VPN goes down, my ISP gets DNS requests to private network addresses and locks down the entire internet connection. They say that is done for security (just for the case if some virus overwrites my system DNS to a custom one).