Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is our network:

WAN <--> Router <--192.168.2.X--> [(eth0) firewall (eth1)] <--192.168.0.X--> LAN

We need to block access from our LAN clients to everything on the Internet except to some ports like SMTP, IMAP and POP. I've tried the rules below but I can't connect to any of the ports that we want to be allowed.

iptables -F
iptables -P FORWARD DROP
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -i eth1 -o eth0 -p tcp --dport smtp -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp --dport pop3 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp --dport imap -j ACCEPT

echo 1 > /proc/sys/net/ipv4/ip_forward

With these rules, the following test fails:

telnet 25

If I flush the rules, the test above succeeds.

Is there something wrong with my rules? Am I missing something?

share|improve this question
Does your network require MASQUERADEing? Leave everything the same, minus the MASQERADE. – TheCompWiz Oct 31 '12 at 16:47
Try adding a iptables -A FORWARD -j LOG and check what's being droped. – Alexander Janssen Oct 31 '12 at 18:22
Thanks for the answers. See the answer below, @Mehdi found the solution for this problem. – Célio Nov 1 '12 at 10:51
up vote 2 down vote accepted

What's the configuration of DNS? If DNS is in outside zone, you need to open DNS query ports (53-udp and tcp)

share|improve this answer
Oopsy. You're right, thanks! The client was unable to resolve the hostname. The following lines solved the problem: iptables -A FORWARD -p tcp --dport 53 -j ACCEPT iptables -A FORWARD -p udp --dport 53 -j ACCEPT – Célio Nov 1 '12 at 10:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.