How to disable local traffic between two local interfaces?

Question

linux

There is linux-box with 3 network interfaces.
eth0 - inet
eth1 - lan1 - gw 192.168.1.1
eth2 - lan2 - gw 192.168.10.1

Users from both networks must have Internet access.

I want to make sure that no one from lan2 can see anything from lan1.

Registered:
iptables -A FORWARD -i eth2 -o eth1 -j DROP

But the user from the lan2 network easily gets access to the IP address on the eth1 interface - 192.168.1.1, which is not desirable.

upd. The following helped:
Thanks for the help!
iptables -L -v
Chain INPUT (policy DROP 21 packets, 1148 bytes)
pkts bytes target prot opt in out source destination
9 488 DROP all -- any any 192.168.10.0/24 192.168.1.0/24


Answer 1

and route -n who will show? you never know what you have heaped up there

Answer 2

<vanga_mode>Do you have eth1 and eth2 plugged into the same switch?</vanga_mode>

Answer 3

try filtering in INPUT additionally

Answer 4

Everything seems to be correct, it’s hard to tell, but I would check
if there is any rule in the FORWARD chain that comes before
iptables -A FORWARD -i eth2 -o eth1 -j DROP
and skips packets
- and everything is separated at the switch level (although this the question has already been asked)
- can not packets be forwarded lan2 - lan0 - lan1, although route seems to be normal ...
- by the way, are the gateways on the machines from lan2 - lan1 correct?
- try writing packets to iptables logs or look at them with tcpdump - to find out how they still leak

Answer 5

Firewall rules work out on the first match from top to bottom. If there is a rule above that this traffic falls under, all the rest will not work.

Answer 6

Install MikroTik ROS and don't worry if there is not a lot of traffic.
Here are the rules from ROS, I think under iptables you will figure out how to rewrite
chain=forward action=drop src-address=192.168.1.0/24 dst-address=192.168.10.0/24
chain=forward action=drop src-address=192.168.10.0 /24 dst-address=192.168.1.0/24
As the rules already said, throw to the very top

Answer 7

192.168.1.1 belongs to the server itself, not the network behind it, so the rules for this case will be different.

Answer 8

*deleted*