Iptable to block routing between interfaces

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
View previous topic :: View next topic  
Author Message
Fedex03
DD-WRT User


Joined: 18 Nov 2010
Posts: 89
Location: Italy
PostPosted: Thu Sep 07, 2023 14:41    Post subject: Iptable to block routing between interfaces Reply with quote
Hi there,

I have 3 LANs:
    br0: trusted network

    br1: IoT network

    br2: Guest network


Every network has its DHCP server and its WiFi network.

I added these rules:
Quote:
# Forward between br0 toward br1
iptables -I FORWARD -i br0 -o br1 -j ACCEPT


Quote:
#Restrict br2 from accessing the router's local sockets (software running on the router)
iptables -I INPUT -i br2 -m state --state NEW -j DROP


I did some test using the Guest WiFi:
    I cannot access br0

    I cannot access DD WRT Web GUI

    I CAN access br1


It seems that the second rule doesn't work.

Any suggestion?

Thank you in advance!
Back to top View user's profile Send private message
Sponsor
ho1Aetoo
DD-WRT Guru


Joined: 19 Feb 2019
Posts: 2607
Location: Germany
PostPosted: Thu Sep 07, 2023 15:31    Post subject: Reply with quote
the input chain is needed because the router provides services like DHCP or DNS forwarding.

The INPUT rule does NOT isolate br2 against br1

if you want to isolate br1 and br2 from each other then you have to use other rules.

for example

Code:
iptables -I FORWARD -i br1 -o br2 -m state --state NEW -j REJECT
iptables -I FORWARD -i br2 -o br1 -m state --state NEW -j REJECT

_________________
use Pi-Hole as simple DNS-Server with DD-WRT https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=331414
VLAN configuration via GUI - 2 CPU ports (R7800, EA8500 etc) https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=334342
Back to top View user's profile Send private message
Wildlion
DD-WRT Guru


Joined: 24 May 2016
Posts: 1389
PostPosted: Thu Sep 07, 2023 21:31    Post subject: Reply with quote
You need to be careful of order of the rules... Did you check any of the boxes with isolate or bridged?
Back to top View user's profile Send private message
Fedex03
DD-WRT User


Joined: 18 Nov 2010
Posts: 89
Location: Italy
PostPosted: Fri Sep 08, 2023 6:26    Post subject: Reply with quote
Wildlion wrote:
You need to be careful of order of the rules... Did you check any of the boxes with isolate or bridged?


HI,

br2 has "Net Isolation" enabled, but from this bridge I can access br1.
Back to top View user's profile Send private message
ho1Aetoo
DD-WRT Guru


Joined: 19 Feb 2019
Posts: 2607
Location: Germany
PostPosted: Fri Sep 08, 2023 6:49    Post subject: Reply with quote
Network isolation only isolates against the main LAN i.e. br0 but not against other bridges with other subnets.
_________________
use Pi-Hole as simple DNS-Server with DD-WRT https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=331414
VLAN configuration via GUI - 2 CPU ports (R7800, EA8500 etc) https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=334342
Back to top View user's profile Send private message
Fedex03
DD-WRT User


Joined: 18 Nov 2010
Posts: 89
Location: Italy
PostPosted: Fri Sep 08, 2023 6:52    Post subject: Reply with quote
ho1Aetoo wrote:
Network isolation only isolates against the main LAN i.e. br0 but not against other bridges with other subnets.


Oh thanks!

Now I can respond to me previous question: br1 cannot access br0 (main bridge) thanks to network isolation. This not work between br2 and br1.

Thank you very much.
Back to top View user's profile Send private message
ho1Aetoo
DD-WRT Guru


Joined: 19 Feb 2019
Posts: 2607
Location: Germany
PostPosted: Fri Sep 08, 2023 7:14    Post subject: Reply with quote
I have already answered your question.

You can isolate the bridges as follows:

Code:
iptables -I FORWARD -i br1 -o br2 -m state --state NEW -j REJECT
iptables -I FORWARD -i br2 -o br1 -m state --state NEW -j REJECT

_________________
use Pi-Hole as simple DNS-Server with DD-WRT https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=331414
VLAN configuration via GUI - 2 CPU ports (R7800, EA8500 etc) https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=334342
Back to top View user's profile Send private message
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum