I want iptables to filter only one interface, eth0, which is facing WAN. How can this be done? And I want to keep ftp and ssh ports open on eth0.
So for all interfaces but one you want to accept all traffic, and on eth0 you want to drop all incoming traffic except ftp and ssh.
First, we could set a policy of accepting all traffic by default.
iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT
Then, we could reset your firewall rules.
Now we could say that we want to allow incoming traffic on eth0 that is a part of a connection we already allowed.
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
Also that we want to allow incoming ssh connections on eth0.
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
But that anything else incoming on eth0 should be dropped.
iptables -A INPUT -i eth0 -j DROP
For slightly more depth see this CentOS wiki entry.
FTP is a trickier than ssh since it can use a random port, so see this previous question.
It is very simple when you make an
iptables rule then you have to specify the interface.
The option to specify the LAN card on which
iptables should work is
Following rules can give you a good example
iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset
Last rule is to reject any other packet which does not match the first 2 rules.
All rules in
iptables are executed in the given order, so the rule to reject packets is always the last.