In an lan intranet like 192.168.123.1/24, how can I block a internet ip like 1.2.3.4…

You can use the following iptables rule to block the internet IP (1.2.3.4) from accessing your LAN intranet (192.168.123.1/24):

iptables -A FORWARD -s 192.168.123.0/24 -d 1.2.3.4 -j DROP

This command will drop any traffic originating from the LAN IP range (192.168.123.0/24) and going to the internet IP (1.2.3.4). However, it will not affect the router and other devices on the network.

Make sure to save the iptables rules using the following command after adding the above rule:

iptables-save > /etc/sysconfig/iptables

This will save the iptables rules to the file /etc/sysconfig/iptables, which will be loaded automatically during system startup.

To block a specific device on your LAN network (let's say device IP is 192.168.123.100) from accessing an internet IP (1.2.3.4) using iptables, but allow other devices and the router to access it, you can use the following iptables rule:

iptables -A FORWARD -s 192.168.123.100 -d 1.2.3.4 -j DROP

This command will drop any traffic originating from the IP 192.168.123.100 and going to the internet IP (1.2.3.4), effectively blocking the device from accessing it. Other devices on the network and the router will not be affected.

Make sure to save your iptables rule using the following command after adding the above rule:

iptables-save > /etc/sysconfig/iptables

This will save your iptables rule to the file /etc/sysconfig/iptables, which will be loaded automatically during system startup.