iptables -A FORWARD -s 192.168.2/24 -d 192.168.1/24 -m conntrack \ --ctstate NEW -m comment --comment 'lan2 cannot see lan1' -j DROP
[...] cheers! :-p Pol