Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following network schema:

  • Computer A: three nics:
    • NIC 1 (eth0): dhcp, public internet
    • NIC 2 (eth1): static, gateway for Computer B
    • NIC 3 (eth2): static, gateway for Computer C

  • Computer B: static, using gateway (NIC 2).

  • Computer C: static, using gateway (NIC 3).

So I applied this to get NAT working:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Every computer can connect to the internet now. I have been applying rules to the main computer (Computer A), like dropping connections to some ports, e.g ssh:

iptables -A INPUT -p tcp --dport 22 -j DROP

But for instance, now I would like only allow connections for ports 20,21,22,53 and 80 in Computer C, and ignore the outside traffic if it's not related to those ports. The allowed connections should be FROM Computer C to outside, but not from outside to Computer C (I mean - Computer C is not hosting any HTTP or SSH, but it is going to use them as a client).

I guess this sould be done like this:

iptables -A OUTPUT -i eth2 -o eth0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth2 -o eth0 -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT

The last rule (dropping any other traffic different from those) is at the end of the configuration, so -A should be working correctly.

The thing is... it is not working. If I put the last rule like this:

iptables -A FORWARD -i eth2 -o eth0 -j DROP

It just drops everything and, for instance, port 21 (previously opened as you can see above) is not either working.

Can you tell me what could I have done wrong? I have been struggling with this problem for some time and I am unable to solve it. Thanks!

share|improve this question

You allow outgoing new/established connections for TCP 21 and you allow incoming established connections for TCP 21. But you drop every trafic in forward chain.

I think the issue comes from here then you should add a forward rule to allow outgoing and incoming trafic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.