Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found masquerading made simple howto very useful and everything works just fine. But I'm not sure about the last line:

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! ppp0 -j ACCEPT
iptables -P INPUT DROP   #only if the first two are succesful
iptables -A FORWARD -i ppp0 -o ppp0 -j REJECT

There is no explanation in the howto. Why is that for?

I guess it's to reject outside-to-inside traffic, but how it works? Maybe it's better to write -i ppp0 -o eth0 (where eth0 is my local network interface)?

share|improve this question
up vote 3 down vote accepted

The FORWARD table is used to manage packets that are being routed though the box. That rule basically stops anything being routed via the ppp0 interface.

share|improve this answer
i still don't understand. My laptop is connected to internet through pc with that configuration. – koddo May 14 '11 at 20:56
iptables works from top down so anything that hasn't been previously matched with respect to the FORWARD table will be rejected by that rule. – Iain May 14 '11 at 20:58
oh, i get it. Thanks. Is it better to drop instead of reject? – koddo May 14 '11 at 21:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.