Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following are my firewall rules. eth1 is the WAN interface and all other are LAN interfaces. I want to filter INPUT and FORWARD chains only on eth1 (WAN interface). All other interfces need not be firewalled. My code sample below works fine. But I feel I need not have so many rules just to have filtering enabled on eth1. So how can I have filtering enabled only on eth1 with just a few number of iptables rules?

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

iptables -P INPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i eth5 -j ACCEPT
iptables -A INPUT -i eth5.20 -j ACCEPT
iptables -A INPUT -i eth5.21 -j ACCEPT
iptables -A INPUT -i eth5.22 -j ACCEPT
iptables -A INPUT -i eth5.23 -j ACCEPT
iptables -A INPUT -i eth5.24 -j ACCEPT
iptables -A INPUT -i eth5.25 -j ACCEPT

iptables -A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -i lo -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
iptables -A IFORWARD -i tap0 -j ACCEPT
iptables -A FORWARD -i eth5 -j ACCEPT
iptables -A FORWARD -i eth5.20 -j ACCEPT
iptables -A FORWARD -i eth5.21 -j ACCEPT
iptables -A FORWARD -i eth5.22 -j ACCEPT
iptables -A FORWARD -i eth5.23 -j ACCEPT
iptables -A FORWARD -i eth5.24 -j ACCEPT
iptables -A FORWARD -i eth5.25 -j ACCEPT

iptables -A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Webserver Ports
iptables -A INPUT -i eth1 -p tcp --match multiport --dports 80,443 -j ACCEPT

# NAT for my local network
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source

# ICMP Protection
iptables -A INPUT -i eth1 -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -i eth1 -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -i eth1 -p icmp -m icmp -m limit --limit 1/second -j ACCEPT

iptables -A INPUT -i eth1 -j DROP
iptables -A FORWARD -i eth1 -j DROP
share|improve this question
up vote 4 down vote accepted

You could always do something like this in the top of each built-in chain:

iptables -I INPUT -i eth1 -j eth1chain
iptables -I INPUT -i eth1 -j DROP

Then whack whatever rules you want into eth1chain to allow traffic (you can skip putting the -i eth1 into those chains, too!), and leave the policy on the main chain as ACCEPT.

However, I wouldn't recommend this. You really are better off using a default deny policy and specifying only the traffic you really want. Using a decent firewall management tool, rather than writing iptables commands directly, can help significantly with that work.

share|improve this answer
I use Shorewall to build my firewalls, and it does a good job of removing redundant rules. You could implement a default ACCEPT policy for all interfaces except eth1, and apply whatever rules you need to eth1. The sample 2 interface setup would be a good starting point for that. I believe all your eth5.xx rules may be redundant. – BillThor Jul 15 '12 at 18:53
@BillThor: No, per-VLAN rules are quite required. – womble Jul 16 '12 at 8:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.