Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Saying I have a linux server as a router from LAN to WAN. I don't want any incoming WAN request for safety issue. So how should I block all the incoming request through the WAN interface, but doesn't limit the LAN users' normal internet activity?

Which application should I use? (iptables?). Which service will be interrupted if I shut up all incoming traffic?

share|improve this question

If you really want to block all incoming traffic from the WAN (or Internet), you can simply add a rule like the the following:

$ iptables -A INPUT -i eth0 -j DROP

assuming eth0 is the WAN interface. This is enough to block all incoming traffic. However, you need to allow all related/established connections to be able to request some service from the WAN/Internet. So, you need a rule like:

$ iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Of course the ACCEPT rule should be added before the DROP rule. Doing so will prevent you from hosting any service within your network.

share|improve this answer
    
What do you mean by the last sentence "Doing so will you prevent you from hosting any service within your network"? What if I do want to provide service for my LAN user? – steveyang Apr 3 '12 at 13:30
    
I think what Khaled meant was that your server won't be able to proivde any services to the outside like FTP, HTTP, etc. – hydroparadise Apr 3 '12 at 13:31
    
@hydroparadise: yes, that's right. Any connection from outside will be blocked. – Khaled Apr 3 '12 at 13:32
    
This is incorrect and Kranthi Guttikonda's answer is right. You need to add the DROP rule on the INPUT chain, not the FORWARD chain. – Dan Lenski May 30 at 1:12
iptables -A FORWARD -i eth0 -j DROP

Will not block incoming traffic. You should add rule on INPUT chain, e.g.:

iptables -A INPUT -i eth0 -j DROP
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.