17

I want iptables to filter only one interface, eth0, which is facing WAN. How can this be done? And I want to keep ftp and ssh ports open on eth0.

  • Please read the iptables man pages - or in case I misunderstood your problem, please make the question more specific. – Jari Jokinen Mar 8 '11 at 17:10
28

So for all interfaces but one you want to accept all traffic, and on eth0 you want to drop all incoming traffic except ftp and ssh.

First, we could set a policy of accepting all traffic by default.

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

Then, we could reset your firewall rules.

iptables -F

Now we could say that we want to allow incoming traffic on eth0 that is a part of a connection we already allowed.

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Also that we want to allow incoming ssh connections on eth0.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

But that anything else incoming on eth0 should be dropped.

iptables -A INPUT -i eth0 -j DROP

For slightly more depth see this CentOS wiki entry.

FTP is a trickier than ssh since it can use a random port, so see this previous question.

| improve this answer | |
  • 7
    WARNING!!! Do "iptables -P..." before "iptables -F". If you're current rules are set to drop traffic by default, running -F will lock you out of your box. This is why keeping the default policy to allow, and to specifically add a rule to drop all other traffic is best practise. – Coops Mar 8 '11 at 20:21
8

Something like this should do the job:

iptables -A INPUT -i eth1 -p all -j DROP
iptables -A INPUT -i eth0 -p all -j ACCEPT
| improve this answer | |
  • 1
    Pretty much spot on (though maybe a bit nicer than "Drop EVERYTHING" on the WAN interface, eh?) -- Write rules to filter the interface you want to filter, and just ACCEPT everything on the other interfaces. – voretaq7 Mar 8 '11 at 17:19
4

The option to specify an interface in your iptables rule is -i, e.g.: -i eth0.

| improve this answer | |
4

It is very simple when you make an iptables rule then you have to specify the interface. The option to specify the LAN card on which iptables should work is -i

Following rules can give you a good example

iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset 

Last rule is to reject any other packet which does not match the first 2 rules. All rules in iptables are executed in the given order, so the rule to reject packets is always the last.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.