Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Saying I have a linux server as a router from LAN to WAN. I don't want any incoming WAN request for safety issue. So how should I block all the incoming request through the WAN interface, but doesn't limit the LAN users' normal internet activity?

Which application should I use? (iptables?). Which service will be interrupted if I shut up all incoming traffic?

share|improve this question

1 Answer 1

If you really want to block all incoming traffic from the WAN (or Internet), you can simply add a rule like the the following:

$ iptables -A FORWARD -i eth0 -j DROP

assuming eth0 is the WAN interface. This is enough to block all incoming traffic. However, you need to allow all related/established connections to be able to request some service from the WAN/Internet. So, you need a rule like:

$ iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Of course the ACCEPT rule should be added before the DROP rule. Doing so will prevent you from hosting any service within your network.

share|improve this answer
    
What do you mean by the last sentence "Doing so will you prevent you from hosting any service within your network"? What if I do want to provide service for my LAN user? –  steveyang Apr 3 '12 at 13:30
    
I think what Khaled meant was that your server won't be able to proivde any services to the outside like FTP, HTTP, etc. –  hydroparadise Apr 3 '12 at 13:31
    
@hydroparadise: yes, that's right. Any connection from outside will be blocked. –  Khaled Apr 3 '12 at 13:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.