I have the following rules and policy in the end of my firewall script:
$IPT=/sbin/iptables
...
$IPT -P FORWARD ACCEPT
$IPT -F FORWARD
# Forward port 2206 to data6
$IPT -A INPUT -i eth1 -s 192.168.1.0/24 -d 6X.XXX.XXX.YY7 -p tcp --destination-port 2206 -j ACCEPT
$IPT -t nat -A PREROUTING -p tcp --dport 2206 -j DNAT --to-destination 192.168.1.2:22
# accept port 22 for the machine 192.168.1.2
$IPT -A FORWARD -j ACCEPT --protocol tcp --destination 192.168.1.2 --destination-port 22
With these rules I can ssh directly to the host 192.168.1.2
with ssh 192.168.1.2
or with
ssh -p 2206 6X.XXX.XXX.YY7
.
I would like change the default forward policy from ACCEPT
to DROP
. However, when I tried this I had no access to the host 192.168.1.2
.
Should I worry about the default accept policy?
How do I adapt the rules to work with the policy DROP
?