0

On my server I have set-up 2 networks (eth1:172.16.1.0/24 and eth2:172.16.2.0/24) which should both communicate to the internet (interface eth0). Thus the server does the masquerading with ufw. /etc/ufw/before.rule thus contains the following rules :

-A POSTROUTING -s 172.16.1.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 172.16.2.0/24 -o eth0 -j MASQUERADE

All that works and from both sub-networks I can access Internet without any problem.

Now I wish to limit the communication between both sub-networks. I have tried for instance :

ufw deny from 172.16.2.0/24 to 172.16.1.0/24

or

ufw deny from 172.16.2.0/24

All this has no effect. It does not stop machines in 172.16.2.0/24 from accessing the computers in 172.16.1.0/24. So how do I filter the traffic between both networks ?

1
  • You can merge that two line MASQUERADE into one line just by changing the first lines net address to 172.16.0.0/22 and then remove the second all together. It will be a tiny bit more efficient. ;-) To help understand this, pleases install sipcalc and try those three network addresses in CIDR format as argument. (I would have used 172.16.0.0/24 and 172.16.1.0/24 and then combined them as 172.16.0.0/23)
    – Anders
    Dec 27, 2015 at 12:32

1 Answer 1

0

You are setting up filtering to and from the machine working as the router, but nothing about how it should or shouldn't forward traffic through the router. To do that, you need to set up FORWARDING rules in the firewall. I belive that ufw has support for that now, using the forward keyword. Please read the documentation for ufw, like the man page, documents in /usr/share/docs/ufw or the programs web page for more information. I don't currently have an access to a computer, so I can't help you with some examples.

But in short. There are three different paths in a firewall that you have to handle. Packages/traffic IN to your router. Packages/traffic OUT from your router. Packages/traffic that is going through your router, that is FORWARDED by the router. They are each filtering independently by each other.

Your examples is all about filtering traffic IN to your router.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .