I want iptables to filter only one interface, eth0, which is facing WAN. How can this be done? And I want to keep ftp and ssh ports open on eth0.

  • Please read the iptables man pages - or in case I misunderstood your problem, please make the question more specific. Mar 8, 2011 at 17:10

4 Answers 4


So for all interfaces but one you want to accept all traffic, and on eth0 you want to drop all incoming traffic except ftp and ssh.

First, we could set a policy of accepting all traffic by default.

iptables -P INPUT ACCEPT

Then, we could reset your firewall rules.

iptables -F

Now we could say that we want to allow incoming traffic on eth0 that is a part of a connection we already allowed.

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Also that we want to allow incoming ssh connections on eth0.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

But that anything else incoming on eth0 should be dropped.

iptables -A INPUT -i eth0 -j DROP

For slightly more depth see this CentOS wiki entry.

FTP is a trickier than ssh since it can use a random port, so see this previous question.

  • 11
    WARNING!!! Do "iptables -P..." before "iptables -F". If you're current rules are set to drop traffic by default, running -F will lock you out of your box. This is why keeping the default policy to allow, and to specifically add a rule to drop all other traffic is best practise.
    – Coops
    Mar 8, 2011 at 20:21

Something like this should do the job:

iptables -A INPUT -i eth1 -p all -j DROP
iptables -A INPUT -i eth0 -p all -j ACCEPT
  • 1
    Pretty much spot on (though maybe a bit nicer than "Drop EVERYTHING" on the WAN interface, eh?) -- Write rules to filter the interface you want to filter, and just ACCEPT everything on the other interfaces.
    – voretaq7
    Mar 8, 2011 at 17:19

The option to specify an interface in your iptables rule is -i, e.g.: -i eth0.


It is very simple when you make an iptables rule then you have to specify the interface. The option to specify the LAN card on which iptables should work is -i

Following rules can give you a good example

iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset 

Last rule is to reject any other packet which does not match the first 2 rules. All rules in iptables are executed in the given order, so the rule to reject packets is always the last.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .