Home / server / Questions / 711225
Accepted
James White
Asked: 2015-08-06 22:23:50 +0800 CST

Blocking LAN client WAN access with a exception rule

  • 772

I'm trying to block a specific client access to the WAN with this:

iptables -I FORWARD -s 192.168.X.X -o $WAN_INTERFACE -j DROP

I however need a exception to allow outbound connections to a specific IP, so I need an ACCEPT rule before it in the right chain.

What is the best way to create this exception and block everything else?

linux

1 Answers

  1. Best Answer

    If you specify -I on iptables then you need to specify the rule number, what you can do is:

    iptables -I FORWARD 1 -s ${limitedClient} -o ${WAN_INTERFACE} -j DROP
iptables -I FORWARD 1 -s ${limitedClient} -d ${limitedClientAccess} -o ${WAN_INTERFACE} -j ACCEPT

    This way you will first insert a rule to deny this IP access to Internet, then you will put in first position a rule allowing specific access to this IP to somewhere.

    • 1