try this: remove default route from eth1 change subnet mask on eth0 to 255.255.0.0 leave subnet mask on eth1 at 255.255.255.0 both interfaces will still work internally, but only eth1 will pass data outside the subnet