I built following network with Ubuntu Server:
Internet ---- eth0 (DHCP, NAT) -- Ubuntu1 -- (eth1 10.1.0.1/16) ------> <------ (eth0 10.1.0.2/16) -- Ubuntu2 -- (eth1 10.2.0.1/16) ------ ...
10.1.0.0/16 - Perimeter network
10.2.0.0/16 - Internal network
Ubuntu1 is a router / firewall between Internet and Perimeter network.
Ubuntu2 is a router / firewall between Perimeter and Internal network.
First I configured both servers as router and I enabled ufw. Ubuntu1 (server between Internet and Perimeter network) is set to MASQUERADE (NAT) on the public NIC and have static route for the Internal network on the eth1. The Ubuntu2 is only a router (net.ipv4.ip_forward=1, net.ipv6.conf.all.forwarding=1).
At this moment everything works and servers on the both networks can access internet and also they can access servers on the opposite network.
Now I want to secure Internal network. I changed setting in the /etc/default/ufw on the Ubuntu2: DEFAULT_FORWARD_POLICY="DROP"
Now I would like to specify IP addresses from the Internal network that can access Perimeter network and Internet. The problem is that I do not know how to do that. On Ubuntu2 I tried:
ufw route allow out on eth0 to 10.2.0.50/16
But the server 10.2.0.50/16 cannot access servers on the Perimeter and also cannot access Internet.
Please can you advise me how to (using ufw) set defined IP addresses that can be routed through Ubuntu2?
Thank you very much.