0

I have the following rules and policy in the end of my firewall script:

$IPT=/sbin/iptables
...
$IPT -P FORWARD ACCEPT
$IPT -F FORWARD


# Forward port 2206 to data6 
$IPT -A INPUT -i eth1 -s 192.168.1.0/24 -d 6X.XXX.XXX.YY7 -p tcp --destination-port 2206 -j ACCEPT
$IPT -t nat -A PREROUTING -p tcp --dport 2206 -j DNAT --to-destination 192.168.1.2:22

# accept port 22 for the machine 192.168.1.2
$IPT -A FORWARD -j ACCEPT --protocol tcp --destination 192.168.1.2 --destination-port 22

With these rules I can ssh directly to the host 192.168.1.2 with ssh 192.168.1.2 or with ssh -p 2206 6X.XXX.XXX.YY7.

I would like change the default forward policy from ACCEPT to DROP. However, when I tried this I had no access to the host 192.168.1.2.

Should I worry about the default accept policy?
How do I adapt the rules to work with the policy DROP?

0

2 Answers 2

2

If you change the default policy to DROP then you need to allow the traffic to come back from 192.168.1.2:22 through the firewall.

$IPT -A FORWARD -j ACCEPT -m conntrack --ctstate ESTABLISHED
$IPT -A FORWARD -j ACCEPT -p tcp -d 192.168.1.2 --dport 22

It may also be necessary to allow reverse DNS lookups by adding :

$IPT -A FORWARD -j ACCEPT -p udp -s 192.168.1.2 --dport 53
1

You can leave the default policy as is and simply add $IPT -A FORWARD -j DROP to the end of the script to effectively drop anything that wasn't previously matched.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .