Enable iptables on one interface

Question

I want iptables to filter only one interface, eth0, which is facing WAN. How can this be done? And I want to keep ftp and ssh ports open on eth0.

Answer 1

So for all interfaces but one you want to accept all traffic, and on eth0 you want to drop all incoming traffic except ftp and ssh.

First, we could set a policy of accepting all traffic by default.

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

Then, we could reset your firewall rules.

iptables -F

Now we could say that we want to allow incoming traffic on eth0 that is a part of a connection we already allowed.

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Also that we want to allow incoming ssh connections on eth0.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

But that anything else incoming on eth0 should be dropped.

iptables -A INPUT -i eth0 -j DROP

For slightly more depth see this CentOS wiki entry.

FTP is a trickier than ssh since it can use a random port, so see this previous question.

Answer 2

Something like this should do the job:

iptables -A INPUT -i eth1 -p all -j DROP
iptables -A INPUT -i eth0 -p all -j ACCEPT

Answer 3

The option to specify an interface in your iptables rule is -i, e.g.: -i eth0.

Answer 4

It is very simple when you make an iptables rule then you have to specify the interface. The option to specify the LAN card on which iptables should work is -i

Following rules can give you a good example

iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset 

Last rule is to reject any other packet which does not match the first 2 rules. All rules in iptables are executed in the given order, so the rule to reject packets is always the last.