I'm wondering about this, and I can't seem to find an explanation on the internet.I have a linux gateway which has multiple interfaces:eth0: external ipeth1: 172.16.1.1/24eth2: 172.16.2.1/24ip_forward is enabled.IPtables is configured to NAT traffic from eth1 -> eth0 and eth2 -> eth0. But configured not to FORWARD traffic between eth1 <-> eth2.My question is: Why is it possible for a computer on the 172.16.2.0/24 subnet to ping 172.16.1.1 (ip address of eth1 interface)?natChain PREROUTING (policy ACCEPT 647K packets, 52M bytes) pkts bytes target     prot opt in     out     source               destination         Chain INPUT (policy ACCEPT 17582 packets, 1160K bytes) pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 14951 packets, 1214K bytes) pkts bytes target     prot opt in     out     source               destination         Chain POSTROUTING (policy ACCEPT 187 packets, 42984 bytes) pkts bytes target     prot opt in     out     source               destination          333K   25M SNAT       all  --  *      eth0    0.0.0.0/0            0.0.0.0/0            to:<external ip>filterChain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination             0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0               0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED    0     0 ACCEPT     tcp  --  eth1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22    0     0 ACCEPT     tcp  --  eth2 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22    0     0 ACCEPT     tcp  --  eth0   *       <some trusted ip>       0.0.0.0/0            tcp dpt:22    0     0 ACCEPT     udp  --  eth1  *       0.0.0.0/0            0.0.0.0/0            udp dpt:53    0     0 ACCEPT     udp  --  eth2  *       0.0.0.0/0            0.0.0.0/0            udp dpt:53    0     0 ACCEPT     icmp --  eth1  *       0.0.0.0/0            0.0.0.0/0               0     0 ACCEPT     icmp --  eth2  *       0.0.0.0/0            0.0.0.0/0           Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination             0     0 ULOG       all  --  eth1  eth0    0.0.0.0/0            0.0.0.0/0            state NEW ULOG copy_range 0 nlgroup 1 prefix NEW:  queue_threshold 1    0     0 ULOG       all  --  eth2  eth0    0.0.0.0/0            0.0.0.0/0            state NEW ULOG copy_range 0 nlgroup 1 prefix NEW:  queue_threshold 1   0 0 ACCEPT     all  --  eth1  eth0    0.0.0.0/0            0.0.0.0/0              0 0 ACCEPT     all  --  eth2  eth0    0.0.0.0/0            0.0.0.0/0              0 0 ACCEPT     all  --  eth0   eth1   0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED   0 0 ACCEPT     all  --  eth0   eth2   0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHEDChain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination             0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
Why can I reach a different interface's IP address?
iptables;routing
My question is: Why is it possible for a computer on the 172.16.2.0/24 subnet to ping 172.16.1.1 (ip address of eth1 interface)?Because you allowed it, and Linux does it by default.Linux uses what is called a weak host model. That mean when it receives a packet coming from eth2, it will consider the packet to be for him if the destination address is an IP address of any of its interfaces, not only eth2's. Even if forwarding is disabled.So that packet enters the PREROUTING hook, the kernel then see that the destination address is its so proceed with the INPUT hook, and you accept all ICMP from eth2, so the packet is accepted.