I have a gateway machine connected to multiple internal networks that I would like to set up NAT on. The catch, though, is that these networks need to be isolated from each other, which I haven’t been able to figure out. Here’s my configuration:
eth0: 192.168.1.0/28 (upstream), gateway is assigned 192.168.1.1
eth1: 192.168.1.16/28 (downstream 1), gateway is assigned 192.168.1.16
eth2: 192.168.1.32/28 (downstream 2), gateway is assigned 192.168.1.32
So far, I’ve configured iptables to allow on default chains:
iptables -P INPUT ALLOW iptables -P OUTPUT ALLOW iptables -P FORWARD ALLOW
Then, I’ve enabled IP forwarding in the kernel and set up iptables:
echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 192.168.1.1 iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT iptables -A FORWARD -i eth2 -o eth0 -j ACCEPT
However, this configuration allows one machine on eth1 to access another machine on eth2, even though I haven’t explicitly specified a rule to allow this. How do I isolate these networks, or at most only allow access to certain hosts/ports?
You set the policy of the
FORWARD chain to
ALLOW, so even if nothing in the chain matches, the traffic will be allowed.
You probably should set it to
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.