iptables -

[J.Witvliet at mindef.nl]

Hi Bob,

As many said before, due to the lack of info, will result in only partly helpful replies.....

1) Decent firewall's have all policies firmly to "DROP" (instead of the default "ACCEPT")
2) Assuming eth0 is your lan-device, (connected to 192.168.1.255/24)
3) Assuming eth1 is connected to your internet modem
4) before (!)  allowing other traffic outside insert
iptables -t filter -A FORWARD -i eth0 -o eth1 --source 192.168.1.17 -j DROP
iptables -t filter -A FORWARD -I eth1 -o eth1 --destination 192.168.1.17 -j DROP
5) next allow other traffic to go outside

Input- and output-chains are only for traffic originating from the box, or having the final destination on the box.
Traffic passing through is handled by the FORWARD-rule.

As I indicated in my top-line, this is very crude, iptables allows making self-defined sub-chains, and many other nice tricks, like timebased rules and so on....

-----Original Message-----
From: users-bounces at lists.fedoraproject.org [mailto:users-bounces at lists.fedoraproject.org] On Behalf Of Mike Wright
Sent: maandag 8 februari 2016 23:25
To: Community support for Fedora users
Subject: Re: iptables -

On 02/08/2016 02:10 PM, Bob Goodwin wrote:
>
> Can someone give me an example [for my router] of the iptables code 
> needed to prevent 192.168.1.17 from connecting to the internet while 
> keeping normal LAN access?

Hi Bob,

Decided lack of info to go on but this will accomplish that.

If you just want the internet to be "non-existent" WRT 192.168.1.17 the easiest way is to DROP all traffic between them.

Let eth0 be the internet connected network card.

iptables -t filter -A INPUT -i eth0 -d 192.168.1.17 -j DROP
iptables -t filter -A OUTPUT -o eth0 -s 192.168.1.17 -j DROP


--
users mailing list
users at lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org

______________________________________________________________________
Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het electronisch verzenden van berichten.

This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.