Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have various machines with a number of network interfaces:

  • eth0: a local LAN
  • eth1: sometimes used for the connection to the Internet gateway
  • ppp0: Modem uplink as an alternative to eth1
  • tun0: OpenVPN tunnel

I want to enable the tun0 to access the local LAN eth0, which is easy with:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 >/proc/sys/net/ipv4/ip_forward

However, how can I disallow packets coming in from eth1 or ppp0 to be routed to eth0 and instead only allow tun0 to use the machine as a gateway?

Do I need to mark these packets using some iptable rules so that I can restrict the MASQUERADE rule to only these packets? Sample iptables configuration greatly appreciated.

Debian Linux 6 on i386; the eth0 subnet varies depending on the machine

share|improve this question
up vote 0 down vote accepted

Section 4.3 should help you out.

With that many interfaces you are going to need some FORWARDING rules. That way you can specify what get's forwarded and to where.

Check out the link I posted and read up a little on it. It can get fairly complicated but that section 4.3 has some good info for what I think you are looking for.

share|improve this answer
Great! That FORWARD chain hint was what I needed. – Udo G May 15 '13 at 12:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.