Configuring iptables for Haproxy

Question

Ubuntu machine running haproxy with 2 network cards, 1 connected to WAN (called wan0) and another connected to LAN (called lan0). All chains set to DROP traffic.

# Masquerade traffic from LAN to WAN
-A POSTROUTING -o wan0 -s 192.168.x.x/24 -j MASQUERADE

# Allow traffic from LAN to WAN
iptables -I FORWARD -i lan0 -o wan0 -j ACCEPT

# Allow HTTP traffic in/out both interfaces
-A INPUT -p tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp --sport 80 -j ACCEPT

*** Is below rule needed? ***
# -A FORWARD -i wan0 -o lan0 -p tcp –dport 80 -j ACCEPT

I want to allow HTTP (port 80) traffic from WAN into the LAN where haproxy will route it to backend servers. Documentation I've read states:

"INPUT, FORWARD, and OUTPUT are separate. A packet will only hit one of the three chains."

Am I missing any iptable rules that would route HTTP (port 80) traffic between interfaces?

Answer 1

As you said, you have the default chain policy set to DROP. So, you need to have explicitly ACCEPT rule for each type of traffic you want to allow.

The following rule will allow traffic passing through your box coming from lan0 interface and going out of interface wan0.

iptables -I FORWARD -i lan0 -o wan0 -j ACCEPT

Also, it is a good idea to allow other types of traffic like RELATED, and ESTABLISHED using a rule like:

iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

This is needed to allow the response traffic to go through. You do similarly for INPUT and OUTPUT chains.

It really depends on your needs and what you want to allow and deny.

As for the sentence:

"INPUT, FORWARD, and OUTPUT are separate. A packet will only hit one of the three chains."

Yes, this is true. A packet will hit:

1. INPUT chain when it is destined to local machine.
2. OUTPUT chain when it is originated from local machine.
3. FORWARD chain otherwise (received from another machine and need to be forwarded to some other machine).