Enable iptables on one interface

Question

I want iptables to filter only one interface, eth0, which is facing WAN. How can this be done? And I want to keep ftp and ssh ports open on eth0.

Answer 1

So for all interfaces but one you want to accept all traffic, and on eth0 you want to drop all incoming traffic except ftp and ssh.

First, we could set a policy of accepting all traffic by default.

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

Then, we could reset your firewall rules.

iptables -F

Now we could say that we want to allow incoming traffic on eth0 that is a part of a connection we already allowed.

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Also that we want to allow incoming ssh connections on eth0.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

But that anything else incoming on eth0 should be dropped.

iptables -A INPUT -i eth0 -j DROP

For slightly more depth see this CentOS wiki entry.

FTP is a trickier than ssh since it can use a random port, so see this previous question.

Answer 2

Something like this should do the job:

iptables -A INPUT -i eth1 -p all -j DROP
iptables -A INPUT -i eth0 -p all -j ACCEPT

Answer 3

It is very simple when you make an IPTABLE rule then you have to specify the interface. The option to specify the LAN card on which IPTABLE should work is -i Following rule can give you a good example

iptables -A INPUT -p tcp  -i eth0 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp  -i eth0 --dport 21 -j ACCEPT
iptables -I INPUT -p tcp -i eth0 -J DENY 

Last rule is to drop any other packet which does not matches first 2 rules. Any rule which comes in IPTABLES first is applied first so the rule to drop packets is always the last.Do a man iptables and search for interface.

Answer 4

Please read the iptables man pages - or in case I misunderstood your problem, please make the question more specific.

Answer 5

The option to specify an interface in your iptables rule is -i, e.g.: -i eth0.