Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am having trouble isolating a specific host from others on my lan.

What I am trying to do is only allow communication between 192.168.0.2. and 192.168.0.8 as well as not allow any other host to access 192.168.0.8

iptables -A FORWARD -s 192.168.0.2 -d 192.168.0.8 -j ACCEPT
iptables -A FORWARD -s 192.168.0.8 -d 192.168.0.2 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/24 -d 192.168.0.8 -j DROP
iptables -A FORWARD -s 192.168.0.8 -d 192.168.0.0/24 -j DROP

Default policy for forwarding is drop.

I have a machine with ip 192.168.0.4 that still can access 192.168.0.8 even after rebooting all machines. What am I doing wrong?

EDIT

(facepalm) I forgot to restore my iptable rules when restarting the firewall. My rules worked just fine once I did that.

share|improve this question
    
Can you post the full output of iptables-save? –  Isaac Freeman May 25 '13 at 18:22
    
Also, which host are these iptables configs set up on? Or is this on a linux-based firewall in between them? –  Isaac Freeman May 25 '13 at 18:24
    
I have this setup on a centos box sitting between the two hosts. –  user650271 May 29 '13 at 2:20

1 Answer 1

Where are these iptables being implemented? On either 0.2 or 0.8? Or is it an intermediary device?

I would recommend, putting these statements on either host:

iptables -A INPUT -s 192.168.0.2 -j ACCEPT
iptables -A INPUT -s 192.168.0.8 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -j DROP

Obviously, use the appropriate first/second statement for whichever machine you are placing these on. For the hosts, the INPUT chain filters all incoming traffic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.