I wrote some rules to prevent all incomming packet from other computers in my private network except my router. That is why I still want my computer to access the Internet.
This is my rules:
iptables -F iptables -P INPUT DROP iptables -A INPUT -m mac --mac-source xx:xx:Xx:xx:xx:xx -j ACCEPT
It is a simple rule. xx:xx:Xx:xx:xx:xx is mac address of the router. I read the document so I know iptables -P INPUT DROP will drop all packets don't match with the below rule. In fact, the rules don't work. I just access to my router but I can not access the Internet. It's difficult to know because I make sure all incomming packets from the Internet come my computer with mac address of my router.
I wrote the rules to fix it:
iptables -F iptables -P INPUT ACCEPT iptables -A INPUT -m mac ! --mac-source xx:xx:xx:xx:Xx:xx -j DROP
It works but I would like the idea "deny all, allow selected". It is simpler in configuration and design.
I hope someone makes me clear why the first rules do not work.