On Fri, Mar 10, 2017 at 12:19:31AM -0800, JW wrote: > Thanks unman, this was very helpful!! I'm new to iptables, so perhaps a basic > question: > > > > There are simple mechanisms to do this: > > > www.qubes-os.org/doc/firewall is helpful. > > > On sys-net you can use an entry in /rw/config/rc.local to set up the new > > > firewall restriction: something like > > > iptables -I FORWARD -s 10.137.100.10 -j DROP > > > iptables -I FORWARD -s 10.137.100.10 -d 10.0.0.0/8 -j ACCEPT > > To recap, I'd like my "restricted" firewall (with IP 10.137.100.10) to grant > access to a 192.168.1.* network, and not allow any traffic to the second > interface on a 10.* network. The "unrestricted" firewall would allow access > to both networks. So in my sys-net, why don't I just do the following? > > iptables -I FORWARD -s 10.137.100.10 -d 10.0.0.0/8 -j DROP > > I ask because the above worked as expected, but when I tried: > > iptables -I FORWARD -s 10.137.100.10 -j DROP > iptables -I FORWARD -s 10.137.100.10 -d 192.0.0.0/8 -j ACCEPT > > I could ping 192.168.1.1, but I could not browse the web on the restricted > firewall. > > Thank you, > > -J >
That's a "recap" that says a good deal more. ;-) I thnk the specification here has changed. If you read my first reply I specifically covered this case, where you wanted to use a gateway on one of the networks, and sugegsted filtering by interface. The difference between the two sets of rules you have posted is that the first only drops traffic to the 10 net, what happens next depends on what other rules in tthe FORWARD chain may come in to play. The second set allows traffic to 192 net and then the 1st rule (whioch appears second because the next instruction INSERTS a rule above it ) drops everything else. So the traffic to 192 net is explicitly allowed and anything else is explicitly dropped. That's why you cant access the web. You can see these rules using 'iptables -L -nv' - remember that the rules apply in order until a match is found. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20170310115223.GB15946%40thirdeyesecurity.org. For more options, visit https://groups.google.com/d/optout.
