Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using iptables it is possible to add a DROP action for some particular source IP and/or destination IP. I want to know if it is possible to DROP a packet based on (default) gateway used?

The iptables will be present on the gateway itself and the DROP rules will be added to the FORWARD chain.

share|improve this question
up vote 2 down vote accepted

No, not really.

The gateway address or default route is only used to choose which interface to send a packet out of and which destination MAC address to use.

An incoming packet contains no information at all about which gateway address the sender used to deliver it. You can only make inferences based on what you know about the topology and interface configuration.

If the destination MAC address only has one IP address associated with it, you can infer that the sender used that IP address to find the MAC address. If you drop packets which have that interface's MAC address, but not that interface's IP address, as the destinations for the frame and packet, you can infer that the sender used that interface's address as the gateway.

If the destination MAC address is on an interface which has multiple addresses in the same subnet, it's impossible to detect which of those addresses the sender used as their gateway.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.