Below is my script for iptables on a Red Hat Fedora server. I run a web server on this linux box on eth0 and connect 2 other computes through a switch on eth1.
Problem 1. --> I can not access the internet from either of the 2 computers interfacing with eth1 on the server through the switch.
Problem 2. --> When I try to access one of the 2 eth1 computers from the internet outside, going to/through the web server/firewall on port 8080, it doesn't work.
Below is my iptable script. Any help will be much appreciated. Thank you.
# (1) Policies (default)
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# (2) User-defined chain for ACCEPTed TCP packets
iptables -N okay
iptables -A okay -p TCP --syn -j ACCEPT
iptables -A okay -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A okay -p TCP -j DROP
# (3) INPUT chain rules
# Rules for incoming packets from LAN
iptables -A INPUT -p ALL -i eth1 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s 10.0.0.1 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s 64.35.156.20 -j ACCEPT
iptables -A INPUT -p ALL -i eth1 -d 10.0.0.255 -j ACCEPT
# Rules for incoming packets from the Internet
# Packets for established connections
iptables -A INPUT -p ALL -d 64.35.156.20 -m state --state ESTABLISHED,RELATED -j ACCEPT
# TCP rules
iptables -A INPUT -p TCP -i eth0 -s 0/0 --destination-port 21 -j okay
iptables -A INPUT -p TCP -i eth0 -s 0/0 --destination-port 22 -j okay
iptables -A INPUT -p TCP -i eth0 -s 0/0 --destination-port 80 -j okay
iptables -A INPUT -p TCP -i eth0 -s 0/0 --destination-port 8080 -j okay
iptables -A INPUT -p TCP -i eth0 -s 0/0 --destination-port 113 -j okay
# UDP rules
iptables -A INPUT -p UDP -i eth0 -s 0/0 --destination-port 53 -j okay
iptables -A INPUT -p UDP -i eth0 -s 0/0 --destination-port 2074 -j okay
iptables -A INPUT -p UDP -i eth0 -s 0/0 --destination-port 4000 -j okay
# ICMP rules
iptables -A INPUT -p ICMP -i eth0 -s 0/0 --icmp-type 8 -j okay
iptables -A INPUT -p ICMP -i eth0 -s 0/0 --icmp-type 11 -j okay
# (4) FORWARD chain rules
# Accept the packets we want to forward
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# (5) OUTPUT chain rules
# Only output packets with local addresses (no spoofing)
iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -p ALL -s 10.0.0.1 -j ACCEPT
iptables -A OUTPUT -p ALL -s 64.35.156.20 -j ACCEPT
# (6) PREROUTING chain rules
iptables -t nat -A PREROUTING -i eth0 -p tcp -d 64.35.156.20 --dport 8080 -j DNAT --to-destination 10.0.0.109
# (7) POSTROUTING chain rules
iptables -t nat -A POSTROUTING -o eth0 -p tcp -s 10.0.0.109 --sport 8080 -j SNAT --to-source 64.35.156.20
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 64.35.156.20
