Making hosts accessible between LAN subnets
- by nixnotwin
I have two inerfaces on my router with tomato firmwre: br0 and vlan4. br0 is on 192.168.0.0/16 subnet and vlan4 on 10.0.1.0/24 subnet. As I don't want the different network services on br0 available on vlan4, I have added this firewall rule:
iptables -I INPUT -i vlan4 -j ACCEPT;
iptables -I FORWARD -i vlan4 -o vlan2 -m state --state NEW -j ACCEPT;
iptables -I FORWARD -i br0 -o vlan4 -j DROP;
vlan2 is my WAN (internet acess).
The issue that I want to solve is that I want to make one host from 192.168.0.0/16 network (br0), which has ip 192.168.0.50, available on vlan4 (10.0.1.0/24). Only that host should be available on vlan4 (and all other hosts on br0 should be inaccessible). What firewall rules can be used to do it?
Edit 1:
Output of iptables -nvL FORWARD:
Chain FORWARD (policy DROP 4 packets, 204 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- vlan4 192.168.0.50 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- vlan4 ppp0 0.0.0.0/0 0.0.0.0/0 state NEW
229 13483 ACCEPT all -- vlan4 vlan2 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 DROP all -- br0 vlan3 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- vlan3 ppp0 0.0.0.0/0 0.0.0.0/0 state NEW
67 3405 ACCEPT all -- vlan3 vlan2 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
34 1360 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
758 40580 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
11781 2111K restrict all -- * vlan2 0.0.0.0/0 0.0.0.0/0
26837 19M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 wanin all -- vlan2 * 0.0.0.0/0 0.0.0.0/0
287 15927 wanout all -- * vlan2 0.0.0.0/0 0.0.0.0/0
283 15723 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0
0 0 upnp all -- vlan2 * 0.0.0.0/0 0.0.0.0/0
Output of iptables -t nat -nvL PREROUTING:
Chain PREROUTING (policy ACCEPT 6887 packets, 526K bytes)
pkts bytes target prot opt in out source destination
855 83626 WANPREROUTING all -- * * 0.0.0.0/0 222.228.137.223
0 0 DROP all -- vlan2 * 0.0.0.0/0 192.168.0.0/16
0 0 DNAT udp -- * * 192.168.0.0/16 !192.168.0.0/16 udp dpt:53 to:192.168.0.1
