I've been using this script on my home LAN for a while now:
http://www.ecst.csuchico.edu/~dranch...ables-stronger

But I recently rebuilt my home server and added a third NIC for a separate
LAN here for testing. I'd like the 2 local LANs to use the external interface for Internet traffic (obviously) but to not be able to talk to each other. I tried to add extra lines to the script by creating a INTIF2, INTNET2, and a INTIP2 in the script and just mirroring the INTIF, INTNET, INTIP lines for it but that did not seem to work - do I need to add a route in there for the new network as well, or am I missing something in my firewall script? The original LAN works great - it's just adding a second LAN subnet that's troubling me.
Thanks in advance.

I think I need to add a route for the new network to allow devices on the 192.168.100.x network to access the Internet. Here's my current routing table:

(IPs changed for protection - yes I know one is invalid!)
Would adding a route for this network (192.168.100.x) be all I need, and if so what would the command be? I have the 192.168.76.x network working exactly the way I want it and have DHCP set up for both networks now.
Thanks!

This illustrates the problem with depending on other people's scripts: the one you have referred to only knows about one external interface and one internal interface. Since your system does not conform to that description, it is unsurprising that it doesn't work.

You do not need to add any routes to your routing table; the networking section of the kernel already knows that you have connectivity to the network 192.168.100.x.

You DO need to improve the rules generated by your script to allow traffic that arrives from the outside world back through your firewall when it is destined for your new network interface. This means that you will need to visit how you are doing SNAT for outbound traffic (a cursory look indicates that is OK as is), and how returning traffic is filtered (the same cursory look indicates that there may be a problem here).

To get the best advice, I recommend that you do not obscure your network setup; that is why you are using a firewall in the first place. I further recommend that you post the resulting iptables rules (in numeric form), rather than asking us to infer them from a script. It makes diagnosis so much easier when one has reliable data upon which to make a diagnosis.

At least you stated one thing useful there, that I did not need to add a route.
After playing around a little I found that with my modifications that traffic was going out, but not coming back. I adjusted the script to fit my needs and posted it here in case anyone else needs something similar.

You're welcome.