this will be the network setup:

WWW eth0 210.14.28.25
------ ---------------
| I |<----------------| Gateway | eth1 195.1.200.8
------ ---------------
^ ^ ^ ^
______________| | | |______________
| | | |
| ____| |____ |
| | | |
------- ------- -------- --------
| W1| |W2 | | W3 | | W4 |
------- ------- -------- --------
195...10 195...11 195...12 195...13

only W1,W4 access the internet.
what will be the iptables rules??

You've got some reading to do
http://www.netfilter.org/

Where did you get the gatway and LAN IP addresses from? Did you just make up a number?

Do some work and we can help you fine tune it (like only allowing W1 and W4 on the internet. Hell we can make it some W1 and W4 are only allowed online at certain times even. Just show some incentive.

the iptables rule you would want to disallow traffic to a given IP is.

iptables -A POSTROUTING -t nat -s $BLOCKED_IP -j REJECT

that one might work or you could do this;

iptables -A FORWARD -s $BLOCKED_IP -d ! $LAN -j REJECT


$BLOCKED_IP would be the ip address
$LAN is the LAN like 192.168.0.1/24 or something to that affect

you could also block based on the MAC address but i have never
written a rule for the MAC but its something like -m mac and some
other stuff.

do "man iptables" and also do what seabass55 said and check
out the netfilter website.

Also you could do a search fo r "iptables" on this site and find many examples.

Thanks 4 help...