Solved

Using iptables with eth0

Posted on 2004-09-04
4
179 Views
Last Modified: 2010-04-22
Here is my setup.

My Fedora2 gets its internet thru the Linksys router and I wanted to relieve my linksys router the job of routing(often times hangs), I wanted the Fedora2 to act as the router.  Now I wanted to prevent specific IP from my network from accessing the internet but allow them to use the remote desktop connection to our headoffice.

1. Specific IPs are allowed to browse the internet
2. Specific IPs are allowed to use Remote Desktop Connection to Head Office but not allowed to browse the internet

How should I do this trick.

thanks in advance

0
Comment
Question by:Sandy Kalugdan
  • 2
  • 2
4 Comments
 
LVL 40

Expert Comment

by:jlevie
ID: 11982474
What you'll want to do is to use a default deny stance for the FORWARD chain and explicitly permit those IP's in category (1) to FORWARD to anywhere. For the users in category (2) you'll want to explicitly permit FORWARD only to the head office IP(s).
0
 
LVL 3

Author Comment

by:Sandy Kalugdan
ID: 11982646
#I did this

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

#enabled this
echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#i want to allow only 192.168.0.250 to browse the net
iptables -A INPUT -s 192.168.0.250 -d 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -s 192.168.0.250 -j ACCEPT

#Disallow this IP from browsing but be able to connect to the #headoffice's IP
iptables -A INPUT -s 192.168.0.251 -d <IP addr> -j ACCEPT
iptables -A FORWARD -s 192.168.0.251 -j ACCEPT


what do you think of this?
0
 
LVL 40

Accepted Solution

by:
jlevie earned 125 total points
ID: 11983071
If you examine the packet flow diagram shown at http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-6.html you'll see that the INPUT chain rules are meaningless as far as access to Internet hosts.  That means that you'd want rules like:

#i want to allow only 192.168.0.250 to browse the net
iptables -A FORWARD -s 192.168.0.250 -d 0.0.0.0/0 -j ACCEPT

#Disallow this IP from browsing but be able to connect to the #headoffice's IP
iptables -A FORWARD -s 192.168.0.251-d <IP addr>  -j ACCEPT
0
 
LVL 3

Author Comment

by:Sandy Kalugdan
ID: 11993554
jlevie,
thanks for pointing out the diagram. actually, it is the one who answered my question.

you really are one of the best in linux security!

good day!
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
Delivering innovative fully-managed cloud services for mission-critical applications requires expertise in multiple areas plus vision and commitment. Meet a few of the people behind the quality services of Concerto.

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now