Why can I reach a different interface's IP address?

view full story

http://unix.stackexchange.com – I'm wondering about this, and I can't seem to find an explanation on the internet. I have a linux gateway which has multiple interfaces: eth0: external ip eth1: eth2: ip_forward is enabled. IPtables is configured to NAT traffic from eth1 -> eth0 and eth2 -> eth0. But configured not to FORWARD traffic between eth1 <-> eth2. My question is: Why is it possible for a computer on the subnet to ping (ip address of eth1 interface)? nat Chain PREROUTING (policy ACCEPT 647K packets, 52M bytes) pkts bytes target prot opt in (HowTos)