restrict traffic to local network only for a server on a lan

[DaggyStyle]

Greetings,

I have a home server with 5 nics, all of them are passed into a vm which acts as a router.
the system has in addition a virtual switch which connects the system and another system vm to the router vm.
for security reasons I want to restrict the home server's to local lan.
the setup is runnall of this is using qemu + libvirt

here is the home server's kernel config:

[jamapii]

Gotcha! Of course not, the (conditional) ACCEPT lines must come first, the DROP lines last.

Alternatively (maybe more secure), you can use "iptables -I" instead of "-A", then the DROP lines come first. But then you must consider your existing rules. They refer to virtsw, but you don't have an IP address there. Weird. (Use ip6tables to deal with ipv6)

Your use of "-s" vs "-d" seems random. It seems to say "what comes in, must come from a local IP address, what goes out, must come from a local IP address". This restricts only incoming traffic. It also blocks multicast. If you have any "ACCEPT ESTABLISHED,RELATED" line, the home server will communicate outside.

I would simply write "-s 10.0.0.0/24 -d 10.0.0.0/24" on both lines. Only local communications allowed.

[Hu]