开启 ip_forward 后如何限制来源 ip

[dogking2]

尝试过用 iptables 限制来源，但是失败了

B 配置：
net.ipv4.ip_forward = 1
iptables -I INPUT -s "C 的 ip" -j DROP

C --> B --> A：
1. C 可以到达 A ，rdp
2. C 不可以到达 B ，ssh

[chengandc]

Assuming that the server knows how to route a packet and that the firewall rules permit its transmission, the following flows represent the paths that will be traversed in different situations:

Incoming packets destined for the local system: PREROUTING -> INPUT
Incoming packets destined to another host: PREROUTING -> FORWARD -> POSTROUTING
Locally generated packets: OUTPUT -> POSTROUTING

在 forward 链里面 drop

[dogking2]

@chengandc 感谢