Blocking traffic

fugzi · 12-04-2004, 02:46 PM

i post a question yesterday and got quick replies and was able to figure out what i had to do based on the answers. thanks for all the help. yesterdays post

now today there is a new question. i want to block all traffic to a specific interface accept one url/ip address. and on the other interface i want to block that specific url/ip address and let everything else pass. how would my iptables command be set up to block all traffic from going out in eth1 besides my.website.edu. and allowing all traffic but my.website.edu on eth0? thanks for the help

mikeyt_333 · 12-04-2004, 03:15 PM

check this out:
http://www.linuxguruz.com/iptables/h...niptables.html

It's just the manpage for iptables. note the -i flag which sets the interface the rule is specific to. I don't quite understand the structure of your traffic blocking, can you maybe refrase it? Checkout the man page and just play around with what does and doesn't work.

HTH
Mike.

fugzi · 12-04-2004, 03:31 PM

i have three nics in my router
eth0 - wan1 10.16.61.241
eth1 - wan2 172.16.62.3
eth2 - lan 192.168.1.1

i want all traffic to go out eth0 except traffic to my.website.edu
i only want traffic to my.website.edu to go out eth1

i am wondering how i would set up.

this is my current iptables rules based on a gentoo howto

Code:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
REJECT     udp  --  anywhere             anywhere            udp dpt:bootps reject-with icmp-port-unreachable
REJECT     udp  --  anywhere             anywhere            udp dpt:domain reject-with icmp-port-unreachable
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             192.168.1.0/24
ACCEPT     all  --  192.168.1.0/24       anywhere
ACCEPT     all  --  anywhere             192.168.1.0/24
ACCEPT     all  --  anywhere             192.168.1.0/24

Chain OUTPUT (policy ACCEPT)