Allow established and related connections
-
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
Administration (VLAN 20) can access everything
-
iptables -A FORWARD -s 192.168.20.0/28 -j ACCEPT
Production (VLAN 10) can only access the Internet and servers as needed
-
iptables -A FORWARD -s 192.168.10.0/27 -o enp0s3 -j ACCEPT
Guests (VLAN 30) can only access the Internet
-
iptables -A FORWARD -s 192.168.50.0/29 -d 192.168.20.0/28 -j DROP
-
iptables -A FORWARD -s 192.168.50.0/29 -d 192.168.10.0/27 -j DROP
-
iptables -A FORWARD -s 192.168.50.0/29 -o enp0s3 -j ACCEPT
Backup (VLAN 40) can talk to Production to make copies
-
iptables -A FORWARD -s 192.168.40.0/26 -d 192.168.10.0/27 -j ACCEPT
-
iptables -A FORWARD -s 192.168.10.0/27 -d 192.168.40.0/26 -j ACCEPT
