The following are my firewall rules. eth1 is the WAN interface and all other are LAN interfaces. I want to filter INPUT and FORWARD chains only on eth1 (WAN interface). All other interfces need not be firewalled. My code sample below works fine. But I feel I need not have so many rules just to have filtering enabled on eth1. So how can I have filtering enabled only on eth1 with just a few number of iptables rules?

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

iptables -P INPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i eth5 -j ACCEPT
iptables -A INPUT -i eth5.20 -j ACCEPT
iptables -A INPUT -i eth5.21 -j ACCEPT
iptables -A INPUT -i eth5.22 -j ACCEPT
iptables -A INPUT -i eth5.23 -j ACCEPT
iptables -A INPUT -i eth5.24 -j ACCEPT
iptables -A INPUT -i eth5.25 -j ACCEPT

iptables -A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -i lo -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
iptables -A IFORWARD -i tap0 -j ACCEPT
iptables -A FORWARD -i eth5 -j ACCEPT
iptables -A FORWARD -i eth5.20 -j ACCEPT
iptables -A FORWARD -i eth5.21 -j ACCEPT
iptables -A FORWARD -i eth5.22 -j ACCEPT
iptables -A FORWARD -i eth5.23 -j ACCEPT
iptables -A FORWARD -i eth5.24 -j ACCEPT
iptables -A FORWARD -i eth5.25 -j ACCEPT

iptables -A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Webserver Ports
iptables -A INPUT -i eth1 -p tcp --match multiport --dports 80,443 -j ACCEPT

# NAT for my local network
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source my.pub.ip.add

# ICMP Protection
iptables -A INPUT -i eth1 -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -i eth1 -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -i eth1 -p icmp -m icmp -m limit --limit 1/second -j ACCEPT

iptables -A INPUT -i eth1 -j DROP
iptables -A FORWARD -i eth1 -j DROP

You could always do something like this in the top of each built-in chain:

iptables -I INPUT -i eth1 -j eth1chain
iptables -I INPUT -i eth1 -j DROP

Then whack whatever rules you want into eth1chain to allow traffic (you can skip putting the -i eth1 into those chains, too!), and leave the policy on the main chain as ACCEPT.

However, I wouldn't recommend this. You really are better off using a default deny policy and specifying only the traffic you really want. Using a decent firewall management tool, rather than writing iptables commands directly, can help significantly with that work.

  • I use Shorewall to build my firewalls, and it does a good job of removing redundant rules. You could implement a default ACCEPT policy for all interfaces except eth1, and apply whatever rules you need to eth1. The sample 2 interface setup would be a good starting point for that. I believe all your eth5.xx rules may be redundant. – BillThor Jul 15 '12 at 18:53
  • @BillThor: No, per-VLAN rules are quite required. – womble Jul 16 '12 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.