I have a network topology:

[C1] - [R1] - [R2] - [C2]

C1-R1 network is
R1-R2 network is
R2-C2 network is

What I need to do is to make C2 be able to connect with C1 by applying some iptables rules to R2. At the same time I don't want C1 to connect to C2. I tried coining some FORWARD chain rules but I just can't get it working.

Is there a simple way to get it working?

Here what iptables -L -v says:

Chain INPUT (policy DROP 5 packets, 372 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy DROP 4 packets, 240 bytes)
pkts bytes target prot opt in out source destination

5 420 REJECT all -- any enp0s3 anywhere anywhere
state NEW reject-with icmp-port-unreachable

Chain OUTPUT (policy DROP 5 packets, 560 bytes)
pkts bytes target prot opt in out source destination

  • 3
    When you say C1 needs to "connect" to C2, what do you mean exactly? Are you going to be using a protocol like TCP or UDP? TCP inherently needs to be able to send return traffic.
    – heavyd
    Apr 25, 2015 at 16:16
  • All of your chains have policy DROP, therefore no packets are ever forwarded. You can either change the policies to ACCEPT or add allow rules.
    – user49740
    Apr 25, 2015 at 16:48

1 Answer 1


Try the state or the conntrack module.

iptables -A FORWARD -o $IFACE -m state --state NEW -j REJECT

where $IFACE is the interface on R2 that connects it to C2.

This way, packets from C1 that would establish a new connection are rejected. Packets from C2 to C1 are unaffected by this rule.

EDIT: Since your FORWARD chain has policy DROP, you will also need rules that allow packets going in the opposite direction, such as:

iptables -A FORWARD -i $IFACE -j ACCEPT
iptables -A FORWARD -o $IFACE -m state ! --state NEW -j ACCEPT
  • Hmm, I tried this one and I can't telnet C1 from C2. I can't even telnet R2 from C2. Apr 25, 2015 at 16:26
  • Do you have any other rules? Adding the output of iptables -L -v to your question might help.
    – user49740
    Apr 25, 2015 at 16:27
  • I have no other rules. The question is updated with the output of iptables -L -v. Apr 25, 2015 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.