Thanks unman, this was very helpful!! I'm new to iptables, so perhaps a basic question:
> > There are simple mechanisms to do this: > > www.qubes-os.org/doc/firewall is helpful. > > On sys-net you can use an entry in /rw/config/rc.local to set up the new > > firewall restriction: something like > > iptables -I FORWARD -s 10.137.100.10 -j DROP > > iptables -I FORWARD -s 10.137.100.10 -d 10.0.0.0/8 -j ACCEPT To recap, I'd like my "restricted" firewall (with IP 10.137.100.10) to grant access to a 192.168.1.* network, and not allow any traffic to the second interface on a 10.* network. The "unrestricted" firewall would allow access to both networks. So in my sys-net, why don't I just do the following? iptables -I FORWARD -s 10.137.100.10 -d 10.0.0.0/8 -j DROP I ask because the above worked as expected, but when I tried: iptables -I FORWARD -s 10.137.100.10 -j DROP iptables -I FORWARD -s 10.137.100.10 -d 192.0.0.0/8 -j ACCEPT I could ping 192.168.1.1, but I could not browse the web on the restricted firewall. Thank you, -J -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/5154fda6-3ed4-4168-a76c-dda036e9c172%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
