Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can someone tell me, if I have rules that are not needed?

I am in particular unsure if

    $IPT -t nat -P PREROUTING ACCEPT                # is this required?
    $IPT -t nat -P INPUT ACCEPT                     # is this required?
    $IPT -t nat -P OUTPUT ACCEPT                    # is this required?

is needed.?

IPT='/sbin/iptables'

LAN_IP_NET="192.168.0.1/24"
WAN_IP="x.x.x.x"

LAN_NET="192.168.245.0/24"

CLIENT_NET1="192.168.245.128/25"  # 192.168.245.128 - 192.168.245.25
CLIENT_NET2="192.168.245.64/26"   # 192.168.245.64  - 192.168.245.12
CLIENT_NET3="192.168.245.32/27"   # 192.168.245.32  - 192.168.245.63
CLIENT_NET4="192.168.245.16/28"   # 192.168.245.16  - 192.168.245.31
CLIENT_NET5="192.168.245.8/29"    # 192.168.245.8   - 192.168.245.15

LAN_NIC="eth1"
WAN_NIC="eth0"

    # Flush everything
    $IPT -F
    $IPT -F -t nat
    $IPT -X
    $IPT -X -t nat


    # Enable packet forwarding
    echo 1 > /proc/sys/net/ipv4/ip_forward

    # Allow all outgoing
    $IPT -P OUTPUT ACCEPT
    $IPT -A OUTPUT -o lo -j ACCEPT

    # Filter rules
    $IPT -A INPUT -i lo -j ACCEPT
    $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    # Allow all traffic from LAN_NET on LAN_NIC
    $IPT -A INPUT -i $LAN_NIC -s $LAN_NET -j ACCEPT

    # Allow some services from the outside
    $IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT
    $IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT
    $IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT

    $IPT -A INPUT -j REJECT



    # Masquerade 192.168.245.8 - 192.168.245.255
    $IPT -t nat -P PREROUTING ACCEPT                # is this required?
    $IPT -t nat -P INPUT ACCEPT                     # is this required?
    $IPT -t nat -P OUTPUT ACCEPT                    # is this required?

    $IPT -t nat -A POSTROUTING -s $CLIENT_NET1 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET2 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET3 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET4 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET5 -o $WAN_NIC -j MASQUERADE


    $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

    # Forward 192.168.245.8 - 192.168.245.255. The first 7 IPs are reserved for failover etc
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET1 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET2 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET3 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET4 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET5 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -j REJECT
share|improve this question

closed as too broad by Magellan, Tim Howland, Scott Pack, dawud, mdpc Oct 11 '13 at 15:24

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

up vote 1 down vote accepted

Policy rules are unlike other rules, and all built-in chains have a policy. They are and implicit part of the chain and specify what to do if no rules in the chain match a packet. Setting the policy to a known value is a good practice.

You could try dropping the rules and seeing if the default policy is ACCEPT following a reboot. As long as the default policy remains ACCEPT, the commands are redundant. However, if someone changes the policy or the default policy changes, your firewall script will no longer do what you wish. Keep those rules even if it appears you don't need them.

Your best choice for a policy is to set it to whatever you want to happen to unmatched packets. For the default chains DROP or REJECT may be a better policy than ACCEPT. For the NAT chains, ACCEPT tends to be a good policy.

share|improve this answer
    
Excellent. I just noticed that I had -P PREROUTING ACCEPT. I suppose I should change that to -P POSTROUTING ACCEPT? –  Sandra Oct 25 '11 at 10:34
    
You should replace INPUT with POSTROUTING. The three default NAT chains are PREROUTING, POSTROUTING, and OUTPUT. –  BillThor Oct 25 '11 at 15:24

the -P rules are the "policy" rules. i.e: the default policy if none of the rules match. In your case they wont do anything because the last like is a reject all anyway, you could use a -P DROP and ditch that reject line also, however I do my firewall the same way you do currently because if you use a -P drop rule and then flush the table remotely using -F you still have the drop policy in place and it cuts out off your connection.

share|improve this answer
    
Does that mean I can remove the 3 rules I mentioned in the post of the post? –  Sandra Oct 24 '11 at 16:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.