The normal approach would be to make firewall rules on your router, but it is possible using iptables. You must have the bridge function enabled for eth1 and let the VM(s) use br1 as their interface. Do the following # Allow local traffic, deny internet iptables -A FORWARD -o br1 -d 192.168.1.0/24 -j ACCEPT iptables -A FORWARD -o br1 -j DROP  
    • Like
    1