Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want iptables to filter only one interface, eth0, which is facing WAN. How can this be done? And I want to keep ftp and ssh ports open on eth0.

share|improve this question
up vote 10 down vote accepted

So for all interfaces but one you want to accept all traffic, and on eth0 you want to drop all incoming traffic except ftp and ssh.

First, we could set a policy of accepting all traffic by default.

iptables -P INPUT ACCEPT

Then, we could reset your firewall rules.

iptables -F

Now we could say that we want to allow incoming traffic on eth0 that is a part of a connection we already allowed.

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Also that we want to allow incoming ssh connections on eth0.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

But that anything else incoming on eth0 should be dropped.

iptables -A INPUT -i eth0 -j DROP

For slightly more depth see this CentOS wiki entry.

FTP is a trickier than ssh since it can use a random port, so see this previous question.

share|improve this answer
WARNING!!! Do "iptables -P..." before "iptables -F". If you're current rules are set to drop traffic by default, running -F will lock you out of your box. This is why keeping the default policy to allow, and to specifically add a rule to drop all other traffic is best practise. – Coops Mar 8 '11 at 20:21

Something like this should do the job:

iptables -A INPUT -i eth1 -p all -j DROP
iptables -A INPUT -i eth0 -p all -j ACCEPT
share|improve this answer
Pretty much spot on (though maybe a bit nicer than "Drop EVERYTHING" on the WAN interface, eh?) -- Write rules to filter the interface you want to filter, and just ACCEPT everything on the other interfaces. – voretaq7 Mar 8 '11 at 17:19

It is very simple when you make an IPTABLE rule then you have to specify the interface. The option to specify the LAN card on which IPTABLE should work is -i Following rule can give you a good example

iptables -A INPUT -p tcp  -i eth0 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp  -i eth0 --dport 21 -j ACCEPT
iptables -I INPUT -p tcp -i eth0 -J DENY 

Last rule is to drop any other packet which does not matches first 2 rules. Any rule which comes in IPTABLES first is applied first so the rule to drop packets is always the last.Do a man iptables and search for interface.

share|improve this answer

The option to specify an interface in your iptables rule is -i, e.g.: -i eth0.

share|improve this answer

Please read the iptables man pages - or in case I misunderstood your problem, please make the question more specific.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.