Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have a some difficulties in configuring my ubuntu server firewall ... my situation is this:

eth0 -> internet

eth1 -> lan1

eth2 -> lan2

I want that clients from lan1 can't communicate with clients from lan2, except for some specific services. E.g. i want that clients in lan1 can ssh into client in lan2, but only that. Any other comunication is forbidden.

So, i add this rules to iptables:

#Block all traffic between lan, but permit traffic to internet
iptables -I FORWARD -i eth1 -o ! eth0 -j DROP
iptables -I FORWARD -i eth2 -o ! eth0 -j DROP
# Accept ssh traffic from lan1 to client 192.168.20.2 in lan2
iptables -A FORWARD -i eth1 -o eth2 -p tcp --dport 22 -d 192.168.20.2 -j ACCEPT

This didn't works. Doing iptables -L FORWARD -v i see:

    Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    33   144 DROP       all  --  eth1 !eth0   anywhere             anywhere
    0     0 DROP       all  --  eth2 !eth0   anywhere             anywhere
23630   20M ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth1   any     anywhere             anywhere
  175  9957 ACCEPT     all  --  eth1 any     anywhere             anywhere
  107  6420 ACCEPT     all  --  eth2 any     anywhere             anywhere
    0     0 ACCEPT     all  --  pptp+  any     anywhere             anywhere
    0     0 ACCEPT     all  --  tun+   any     anywhere             anywhere
    0     0 ACCEPT     tcp  --  eth1 eth2  anywhere             server2.lan tcp dpt:ssh

All packets are dropped, and the count of packets for the last rule is 0 ...

How i have to modify my configuration? Thank you.

Regards Marco

share|improve this question

1 Answer 1

Your DROPs are at the front of the chain (and will be processed first). You want to put the DROPs after the rule that permits SSH access for the SSH rule to be used.

Something like this should work:

#Accept ssh traffic from lan1 to client 192.168.20.2 in lan2
iptables -A FORWARD -i eth1 -o eth2 -p tcp --dport 22 -d 192.168.20.2 -j ACCEPT

#Block all traffic between lan, but permit traffic to internet
iptables -A FORWARD -i eth1 -o ! eth0 -j DROP
iptables -A FORWARD -i eth2 -o ! eth0 -j DROP

(use the -A to append these rules to the end of the chain)

share|improve this answer
    
Ok, i've tried, but now ALL the traffic goes through. Doing iptables -L FORWARD -v shows that the DROP rules are never touched. I think the DROP rules have to be on top: deny all, accept few. –  Marco Aug 23 '11 at 16:29
    
Oh, your list of rules has something that looks like it accepts any to any. –  cjc Aug 23 '11 at 16:43
    
I have a feeling everything in your rules can be expressed more succinctly, but I don't time to look closely. For the question itself, put the rule allowing SSH before the rules DROPping the traffic. iptables rules are processed in order, so precedence matters. For your code snippet, you can use "-I" instead of "-A" to insert the SSH rules instead of appending. As this was the last insert, it should be put into the chain before the DROP rules. –  cjc Aug 23 '11 at 18:23
    
Ok, i've stared from a set of rules and tried to add mine. Now i created only the rules that i strictly need in the order you suggest. It works. Thank you. –  Marco Aug 24 '11 at 9:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.