Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

im trying to configure a firewall. It has to network interfaces, eth0 (lan) and eth1 (wan).

allow-hotplug eth1
auto eth1
iface eth1 inet static

allow-hotplug eth0
auto eth0
iface eth0 inet static

Behind eth1 is a router that gives me an dynamic ip.

I the same machine, there is a web-proxy. Actually, the computer on the lan can access the web only using the proxy. Now, i need machines in the lan to access SMTP and POP3 servers over the internet. So i need NAT, but just for port 25 and 110. I dont want to nat other ports.

Can you help me to configure iptables step by step (im really noob at iptables)?


share|improve this question
Hi there! Did you solve this problem? I'm stuck here too :( – Pitto Dec 9 '11 at 14:45
I've read your comments to the answers below, and I have to first ask a question: What's the Default Gateway of the clients? Where do the clients get their IP addresses? – pepoluan Dec 9 '11 at 17:38
up vote 4 down vote accepted

The code below will do the job. Iptables is easy enough to work with - you just have to be explicit about telling it what to do with traffic that comes from or goes to specific locations on specific ports. Although you only requested ports 25 and 110, I included options for secure SMTP and secure POP3 as well.

What I recommend below takes into account whatever firewall rules you have in place and puts the rules you've requested higher in the processing order than anything else. Iptables processes rules in the order that it matches them, so just in case you have other rules already in the firewall that might block SMTP or POP3, I used the insert command and specified the rules should be placed at the top of the list. If you don't have any other firewall rules, then you could substitute the "-I" with "-A" and drop the line numbers after the "FORWARD" and "POSTROUTING" tables.

I recommend implementing connection tracking whenever you can and the first iptables rule below turns that on. If you're running on a really old kernel then you might have issues with these commands, but if they work for you, then great. If they don't, then drop that first line, and drop the "-m tcp" portion of all the other lines.

#Enable IP Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

#Turn on connection tracking
iptables -I FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

#Allow SMTP traffic out to the internet. This includes regular and authenticated SMTP
iptables -I FORWARD 2 -i eth1 -p tcp -m tcp --dport 25 -j ACCEPT
iptables -I FORWARD 2 -i eth1 -p tcp -m tcp --dport 465 -j ACCEPT
iptables -I FORWARD 3 -i eth1 -p tcp -m tcp --dport 587 -j ACCEPT

#Allow POP3 traffic out to the internet. This includes regular and SSL secured POP3
iptables -I FORWARD 4 -i eth1 -p tcp -m tcp --dport 110 -j ACCEPT
iptables -I FORWARD 5 -i eth1 -p tcp -m tcp --dport 995 -j ACCEPT

#NAT the traffic leaving your router for the allowed forwarded ports above
iptables -t nat -I POSTROUTING 1 -o eth0 -p tcp --dport 25 -j MASQUERADE
iptables -t nat -I POSTROUTING 2 -o eth0 -p tcp --dport 465 -j MASQUERADE
iptables -t nat -I POSTROUTING 3 -o eth0 -p tcp --dport 587 -j MASQUERADE
iptables -t nat -I POSTROUTING 4 -o eth0 -p tcp --dport 110 -j MASQUERADE
iptables -t nat -I POSTROUTING 5 -o eth0 -p tcp --dport 995 -j MASQUERADE

#Optionally, block any other forwarded traffic
iptables -I FORWARD 6 -i eth1 -j REJECT
share|improve this answer
Hey, i did all the steps, but i get this (from the lan). could not resolve Name or service not known :( any idea? – Emmet Brown Sep 30 '11 at 2:51
Maybe because the firewall is not the defalt gateway? :( – Emmet Brown Sep 30 '11 at 13:58
exactly ... look at the comment on my answer. – Torian Sep 30 '11 at 15:49
Another thing ... if you dont have an internal DNS, you should consider iptables -I FORWARD -i eth0 -o eth1 -p udp --dport 53 -j ACCEPT – Torian Sep 30 '11 at 15:51
I've tried this solution but it won't work in my network... Outlook keeps on givine me errors :( – Pitto Dec 9 '11 at 15:58

Easy peasy lemon squeezy:

iptables -t nat -A POSTROUTING -p TCP --dport 25 -j MASQUERADE

iptables -t nat -A POSTROUTING -p TCP --dport 110 -j MASQUERADE


share|improve this answer

First things first:

allow-hotplug eth0
auto eth0
iface eth0 inet static

Is wrong (or a typo ;)). broadcast should be

Asuming that every computer has as its default gateway this linux box ( it is just a matter of configuring ip forwarding:

 # Enable ip forward:
 echo 1 > /proc/sys/net/ipv4/ip_forward
 # The same cam be achieved by:
 #  sysctl -w net.ipv4.ip_forward=1

 # Forwarding traffic between interfaces:
 iptables -A FORWARD -i eth0 -o eth1 --src -p tcp --dport 25 -j ACCEPT
 iptables -A FORWARD -i eth0 -o eth1 --src -p tcp --dport 110 -j ACCEPT
 # This rule prevents other traffic to be dropped
 iptables -A FORWARD -i eth0 -o eth1 --src -j DROP

 # Masquerade traffic to the outside world:
 # If the public ip is a dynamic one use MASQUERADE
 iptables -t nat -A POSTROUTING -o eth1 --src -j MASQUERADE

 # If the public ip is a static one, use SNAT
 iptables -t nat -A POSTROUTING -o eth1 --src -j SNAT --to-source <pub_ip>

When the public connection comes up, if it creates a ppp link,then you'll have to replace eth1 with, let's say, ppp0.

BEAWARE: this is by no means a strong firewall, it is just a minimal set of rules to do what you want.

share|improve this answer
Nope, the default gateway is not that machine, is the router. This is only the firewall :( – Emmet Brown Sep 30 '11 at 2:44
If this is not the default gateway, then the router should send everything through this host ... In general, if the firewall is not the default gateway, it is the nexthop after the router (or a stealth one between the router and the rest of the net). – Torian Sep 30 '11 at 15:49
yes, the firewall is between the router and the wan. Should i configure the router? – Emmet Brown Oct 3 '11 at 13:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.