User's Guide

Chapter 16: Controlling Access to the ER-1000
TR0190 Rev. A1 106
rules for iptables, with the exception of the chain that they are to be added to cannot be
specified. All rules will be applied to the iptables forwarding chain.
List one rule per line in the text box on the “Custom Rules” tab and click on the “Save and
Apply Changes” button when all rules have been entered. The following examples of custom
rules illustrate how to use the custom firewall interface.
Blocking SMTP traffic 25
This rule will block all SMTP traffic, which uses port 25.
-dport 25 -j DROP
Limiting Access Based on Client Access Interface
Packets can be filtered based upon which interface they were received through. For example,
wlan1 and wlan2 can be used to provide users with access to two different, private subnets,
while wlan3 users have access to neither of these subnets. Users of all wlans would have
access to the Internet though. The following rules will:
• Drop traffic from wlan1 destined for the 192.168.2.0 subnet
• Drop traffic from wlan2 destined for the 192.168.1.0 subnet
• Drop traffic from wlan3 destined for the 192.168.1.0 and 192.168.2.0 subnets
-i wlan1 --dst 192.168.2.0/24 -j DROP
-i wlan2 --dst 192.168.1.0/24 -j DROP
-i wlan3 --dst 192.168.1.0/24 -j DROP
-i wlan3 --dst 192.168.2.0/24 -j DROP