All PCs have br0
and br1
interfaces, and all IPs are in the same network 192.168.1.0/24
and 192.168.2.0/24
. IP forwarding
is enabled in all PCs.
All PCs are connected to the same switch. When no rules defined in the iptables
, all PCs can ping
and ssh
to each other.
PC1: br0: 192.168.1.1 br1: 192.168.2.1 rules in FORWARD: iptables -A FORWARD -i br0 -o br1 -j ACCEPT iptables -A FORWARD -i br1 -o br0 -j ACCEPTPC2: br0: 192.168.1.2 br1: 192.168.2.2 rules in FORWARD: iptables -A FORWARD -i br0 -o br1 -j ACCEPT iptables -A FORWARD -i br1 -o br0 -j ACCEPTPCn: br0: 192.168.1.n br1: 192.168.2.n rules in FORWARD: iptables -A FORWARD -i br0 -o br1 -j ACCEPT iptables -A FORWARD -i br1 -o br0 -j ACCEPT
Now, I want to block PC1
from accessing PC2
and PCn
, and vice versa (PC2
and PCn
can't access PC1
), that is, PC1
only allowed to send
and receive
all packets in localhost
.
iptables -A INPUT -j DROPiptables -A OUTPUT -j DROP
Is is enough for blocking all non-localhost
packets with the above two iptables rules in the INPUT
and OUTPUT
? If not, what rules should be used to block all non-localhost
packets?