On my server I have set-up 2 networks (eth1:172.16.1.0/24 and eth2:172.16.2.0/24) which should both communicate to the internet (interface eth0). Thus the server does the masquerading with ufw. /etc/ufw/before.rule thus contains the following rules :
-A POSTROUTING -s 172.16.1.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 172.16.2.0/24 -o eth0 -j MASQUERADE
All that works and from both sub-networks I can access Internet without any problem.
Now I wish to limit the communication between both sub-networks. I have tried for instance :
ufw deny from 172.16.2.0/24 to 172.16.1.0/24
or
ufw deny from 172.16.2.0/24
All this has no effect. It does not stop machines in 172.16.2.0/24 from accessing the computers in 172.16.1.0/24. So how do I filter the traffic between both networks ?