| View previous topic :: View next topic |
| Author |
Message |
tuxwatcher
Tux's lil' helper
Joined: 05 Jun 2003
Posts: 121
Location: USA
|
 Posted: Wed Aug 04, 2004 7:33 pm Post subject: Routing, ipforward, iptables question? |
 |
|
I have a gateway setup on my network. It has virtual IP's on several subnets. and some additional routing info: | Code: | #route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
mydomain * 255.255.255.240 U 0 0 0 eth0
192.168.6.0 vpn0 255.255.255.0 UG 0 0 0 eth1
192.168.22.0 vpn0 255.255.255.0 UG 0 0 0 eth1
192.168.5.0 * 255.255.255.0 U 0 0 0 eth1
192.168.21.0 vpn0 255.255.255.0 UG 0 0 0 eth1
192.168.4.0 * 255.255.255.0 U 0 0 0 eth1
192.168.3.0 * 255.255.255.0 U 0 0 0 eth1
192.168.2.0 * 255.255.255.0 U 0 0 0 eth1
192.168.18.0 fh-router 255.255.255.0 UG 0 0 0 eth1
192.168.1.0 * 255.255.255.0 U 0 0 0 eth1
192.168.17.0 fh-router 255.255.255.0 UG 0 0 0 eth1
192.168.0.0 * 255.255.255.0 U 0 0 0 eth1
192.168.16.0 th-cpd3 255.255.255.0 UG 0 0 0 eth1
192.168.15.0 th-cpd3 255.255.255.0 UG 0 0 0 eth1
192.168.10.0 th-cpd4 255.255.255.0 UG 0 0 0 eth1
loopback localhost 255.0.0.0 UG 0 0 0 lo
default mydomain 0.0.0.0 UG 0 0 0 eth0 |
this machine is also doing nat for the network to internet. | Code: | # iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 192.168.1.0/24 mailserver to:xxx.xxx.xxx.xxx
SNAT all -- 192.168.2.0/24 mailserver to:xxx.xxx.xxx.xxx |
My problem is that the subnets can all see each other even if I flush the iptables. What do I need to do to block the subnets from each other but still nat them to the internet.
Last edited by tuxwatcher on Thu Aug 05, 2004 2:33 pm; edited 2 times in total |
|
| Back to top |
|
 |
tuxwatcher
Tux's lil' helper
Joined: 05 Jun 2003
Posts: 121
Location: USA
|
| Posted: Thu Aug 05, 2004 2:31 pm Post subject: |
|
|
I found a possible solution using iptables. I typed. | Code: | | iptables -A FORWARD -s 192.168.0.0/255.255.0.0 -d 192.168.0.0/255.255.0.0 -j REJECT --reject-with icmp-host-unreachable |
It appears to be doing what I want at this point |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
