Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Using iptables with eth0

Posted on 2004-09-04
4
Medium Priority
?
212 Views
Last Modified: 2010-04-22
Here is my setup.

My Fedora2 gets its internet thru the Linksys router and I wanted to relieve my linksys router the job of routing(often times hangs), I wanted the Fedora2 to act as the router.  Now I wanted to prevent specific IP from my network from accessing the internet but allow them to use the remote desktop connection to our headoffice.

1. Specific IPs are allowed to browse the internet
2. Specific IPs are allowed to use Remote Desktop Connection to Head Office but not allowed to browse the internet

How should I do this trick.

thanks in advance

0
Comment
Question by:Sandy Kalugdan
  • 2
  • 2
4 Comments
 
LVL 40

Expert Comment

by:jlevie
ID: 11982474
What you'll want to do is to use a default deny stance for the FORWARD chain and explicitly permit those IP's in category (1) to FORWARD to anywhere. For the users in category (2) you'll want to explicitly permit FORWARD only to the head office IP(s).
0
 
LVL 3

Author Comment

by:Sandy Kalugdan
ID: 11982646
#I did this

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

#enabled this
echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#i want to allow only 192.168.0.250 to browse the net
iptables -A INPUT -s 192.168.0.250 -d 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -s 192.168.0.250 -j ACCEPT

#Disallow this IP from browsing but be able to connect to the #headoffice's IP
iptables -A INPUT -s 192.168.0.251 -d <IP addr> -j ACCEPT
iptables -A FORWARD -s 192.168.0.251 -j ACCEPT


what do you think of this?
0
 
LVL 40

Accepted Solution

by:
jlevie earned 375 total points
ID: 11983071
If you examine the packet flow diagram shown at http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-6.html you'll see that the INPUT chain rules are meaningless as far as access to Internet hosts.  That means that you'd want rules like:

#i want to allow only 192.168.0.250 to browse the net
iptables -A FORWARD -s 192.168.0.250 -d 0.0.0.0/0 -j ACCEPT

#Disallow this IP from browsing but be able to connect to the #headoffice's IP
iptables -A FORWARD -s 192.168.0.251-d <IP addr>  -j ACCEPT
0
 
LVL 3

Author Comment

by:Sandy Kalugdan
ID: 11993554
jlevie,
thanks for pointing out the diagram. actually, it is the one who answered my question.

you really are one of the best in linux security!

good day!
0

Featured Post

Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
This Micro Tutorial will teach you how to add a cinematic look to any film or video out there. There are very few simple steps that you will follow to do so. This will be demonstrated using Adobe Premiere Pro CS6.
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
Suggested Courses

885 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question