Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is our network:

WAN <--> Router <--192.168.2.X--> [(eth0) firewall (eth1)] <--192.168.0.X--> LAN

We need to block access from our LAN clients to everything on the Internet except to some ports like SMTP, IMAP and POP. I've tried the rules below but I can't connect to any of the ports that we want to be allowed.

iptables -F
iptables -P FORWARD DROP
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -i eth1 -o eth0 -p tcp --dport smtp -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp --dport pop3 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp --dport imap -j ACCEPT

echo 1 > /proc/sys/net/ipv4/ip_forward

With these rules, the following test fails:

telnet smtp.gmail.com 25

If I flush the rules, the test above succeeds.

Is there something wrong with my rules? Am I missing something?

share|improve this question
    
Does your network require MASQUERADEing? Leave everything the same, minus the MASQERADE. –  TheCompWiz Oct 31 '12 at 16:47
    
Try adding a iptables -A FORWARD -j LOG and check what's being droped. –  Alexander Janssen Oct 31 '12 at 18:22
    
Thanks for the answers. See the answer below, @Mehdi found the solution for this problem. –  Célio Nov 1 '12 at 10:51

1 Answer 1

up vote 2 down vote accepted

What's the configuration of DNS? If DNS is in outside zone, you need to open DNS query ports (53-udp and tcp)

share|improve this answer
    
Oopsy. You're right, thanks! The client was unable to resolve the hostname. The following lines solved the problem: iptables -A FORWARD -p tcp --dport 53 -j ACCEPT iptables -A FORWARD -p udp --dport 53 -j ACCEPT –  Célio Nov 1 '12 at 10:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.