Solved

Using iptables with eth0

Posted on 2004-09-04
4
175 Views
Last Modified: 2010-04-22
Here is my setup.

My Fedora2 gets its internet thru the Linksys router and I wanted to relieve my linksys router the job of routing(often times hangs), I wanted the Fedora2 to act as the router.  Now I wanted to prevent specific IP from my network from accessing the internet but allow them to use the remote desktop connection to our headoffice.

1. Specific IPs are allowed to browse the internet
2. Specific IPs are allowed to use Remote Desktop Connection to Head Office but not allowed to browse the internet

How should I do this trick.

thanks in advance

0
Comment
Question by:Sandy Kalugdan
  • 2
  • 2
4 Comments
 
LVL 40

Expert Comment

by:jlevie
ID: 11982474
What you'll want to do is to use a default deny stance for the FORWARD chain and explicitly permit those IP's in category (1) to FORWARD to anywhere. For the users in category (2) you'll want to explicitly permit FORWARD only to the head office IP(s).
0
 
LVL 3

Author Comment

by:Sandy Kalugdan
ID: 11982646
#I did this

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

#enabled this
echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#i want to allow only 192.168.0.250 to browse the net
iptables -A INPUT -s 192.168.0.250 -d 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -s 192.168.0.250 -j ACCEPT

#Disallow this IP from browsing but be able to connect to the #headoffice's IP
iptables -A INPUT -s 192.168.0.251 -d <IP addr> -j ACCEPT
iptables -A FORWARD -s 192.168.0.251 -j ACCEPT


what do you think of this?
0
 
LVL 40

Accepted Solution

by:
jlevie earned 125 total points
ID: 11983071
If you examine the packet flow diagram shown at http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-6.html you'll see that the INPUT chain rules are meaningless as far as access to Internet hosts.  That means that you'd want rules like:

#i want to allow only 192.168.0.250 to browse the net
iptables -A FORWARD -s 192.168.0.250 -d 0.0.0.0/0 -j ACCEPT

#Disallow this IP from browsing but be able to connect to the #headoffice's IP
iptables -A FORWARD -s 192.168.0.251-d <IP addr>  -j ACCEPT
0
 
LVL 3

Author Comment

by:Sandy Kalugdan
ID: 11993554
jlevie,
thanks for pointing out the diagram. actually, it is the one who answered my question.

you really are one of the best in linux security!

good day!
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now