I have various machines with a number of network interfaces:
- eth0: a local LAN
- eth1: sometimes used for the connection to the Internet gateway
- ppp0: Modem uplink as an alternative to eth1
- tun0: OpenVPN tunnel
I want to enable the
tun0 to access the local LAN
eth0, which is easy with:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE echo 1 >/proc/sys/net/ipv4/ip_forward
However, how can I disallow packets coming in from
ppp0 to be routed to eth0 and instead only allow
tun0 to use the machine as a gateway?
Do I need to mark these packets using some iptable rules so that I can restrict the MASQUERADE rule to only these packets? Sample iptables configuration greatly appreciated.
Debian Linux 6 on i386; the
eth0 subnet varies depending on the machine