2

I have two Tomato firmware routers setup. Router X is connected to the internet via it's WAN port. The router Y's WAN is connected to router X's LAN1 port. I'd like to restrict router Y so that it can only connect to the internet and not access the local network on router X. I have tried using these iptables on router X:

iptables -I FORWARD -m mac --mac-source XX:XX:XX:XX:XX -d 192.168.1.0/24 -j DROP
iptables -I FORWARD -s 192.168.1.18 -d 192.168.1.0/24 -j DROP

I have tried both of these rules separately and together (on router X) and yet I can still access the lan on router X while connected to router Y? (1.18 is router Y's WAN address and it runs it's own NAT network)

I have tried TCPDUMP on router X and don't even see the traffic access to the LAN, yet it connects?

network layout

4
  • Do you trust router Y? If that’s the case, you could enforce those restrictions there.
    – Daniel B
    Jun 29, 2016 at 15:38
  • It is definitely less trust worthy than router X, but yes, I guess I could drop all packets destined for router X via iptables on router Y. Thanks.
    – Leo
    Jun 30, 2016 at 13:26
  • No, that’s not the correct rule. You need to disallow packets targeted at LAN address ranges. Otherwise, you’ll have to look into VLANs. Whether or not your router is VLAN-capable varies. That way, you could split the switch so that traffic has to go through Linux.
    – Daniel B
    Jun 30, 2016 at 14:11
  • Hmmm...so putting all traffic on VLANs will make it all go through the router. Interesting. My routers do support this. I also tried blocking ranges on router Y, but with INPUT it blocked all traffic, and with FORWARD it didn't block any: iptables -I INPUT -d 192.168.19.0/24 -j DROP iptables -I INPUT -d 192.168.22.0/24 -j DROP or iptables -I FORWARD -d 192.168.19.0/24 -j DROP iptables -I FORWARD -d 192.168.22.0/24 -j DROP
    – Leo
    Jul 1, 2016 at 1:15

2 Answers 2

1

Since you don’t mention your router’s make and model, here’s the general idea: A consumer-grade router generally consists of a “WAN” port and a number of “LAN” ports. Most cheap router SoCs have two integrated network interfaces, one for WAN and one for LAN. Of course that doesn’t match up with the number of LAN ports—there’s a built-in switch.

In most routers, these switches are in fact programmable. They can do port-based VLANs and VLAN tagging. That means you can create a “physically separated“ network interface.

Usually it’s like this:

   +-------------+  +--------------+
   |     CPU     |  |         LAN1 |--
 --| WAN     LAN |--| Switch  LAN2 |--
   +-------------+  |         LAN3 |--
                    +--------------+

Whatever is connected at LAN1 (where your router Y is connected) has full access to LAN2 and LAN3.

However, we can reconfigure the switch and create two VLANs:

   +---------------+  +--------------+
   |     CPU       |  |    Switch    |
   |         LAN.1 |--| VLAN1   LAN1 |--
 --| WAN           |  +--------------+
   |         LAN.2 |--| VLAN2   LAN2 |--
   +---------------+  |         LAN3 |--
                      +--------------+

After setting everything up, each VLAN will appear as a separate network interface to the system. Because LAN1 is no longer on the same broadcast domain with LAN2/3, the OS receives the traffic and can decide whether to forward packets from VLAN1 to VLAN2.

To avoid confusion, you’d usually pick a different subnet for different VLANs, so the router really has to route. :)

Whether Tomato can do that, I do not know. OpenWrt can, and IIRC so can DD-WRT. It’s essentially a wired guest network.

If you can’t provide that level of isolation, you need to try and filter on router Y, using rules somewhat like these:

iptables -A FORWARD -d 192.168.0.0/16 -j DROP
iptables -A FORWARD -d 172.16.0.0/12 -j DROP
iptables -A FORWARD -d 10.0.0.0/8 -j DROP

That of course relies on router Y to enforce the policy you desire.

0

The problem is that router Y does not need the FORWARD chain to reach your internal network. Its WAN interface is 192.168.1.18 and so any packets bound for 192.168.1.0/24 that hit this interface will be routed locally without ever hitting FORWARD.

I expect if you change FORWARD to INPUT on your second rule, things will start working as you intend:

iptables -I INPUT -s 192.168.1.18 -d 192.168.1.0/24 -j DROP
5
  • Unfortunately not - I changed the rule to INPUT and I can still access the router X local network from router Y. Yet with either FORWARD or INPUT (or both) I cannot access the internet from devices connected via router Y. Which is the exact opposite of what I want. I want them to be able to access the internet and NOT other devices connected to router X.
    – Leo
    Jun 28, 2016 at 2:18
  • More details are needed then. What network is router X set to? What about router Y? What do the iptables (filter and nat) and route tables look like for both? There's no reason what you are trying to do won't work, so something else is going on..
    – Mark
    Jun 29, 2016 at 4:43
  • Thanks Mark. I added a network layout diagram to the original question (but it only shows up as a link). Router Y is doing NAT for it's local network and it's WAN is plugged into the LAN of router X which is running it's on NAT for it's LAN. But as I said, even using tcpdump on router X doesn't show any local traffic coming from router Y or any of it's clients. Which is why I think the hardware switch in X is routing the packets to the LAN hosts without consulting ther kernel/iptables.
    – Leo
    Jun 29, 2016 at 15:26
  • INPUT won’t work either because the router never sees the packages. It’s a switch, after all.
    – Daniel B
    Jun 29, 2016 at 15:37
  • Good call, @DanielB. In a similar scenario I was using for reference, I'm using a pi2 with multiple interfaces, so in my case the equivalent of router X is a pi2 and the network router Y is coming in on is a separate ethernet interface and does hit INPUT as packets flow in.
    – Mark
    Jul 1, 2016 at 4:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .