Solved

Using iptables with eth0

Posted on 2004-09-04
4
187 Views
Last Modified: 2010-04-22
Here is my setup.

My Fedora2 gets its internet thru the Linksys router and I wanted to relieve my linksys router the job of routing(often times hangs), I wanted the Fedora2 to act as the router.  Now I wanted to prevent specific IP from my network from accessing the internet but allow them to use the remote desktop connection to our headoffice.

1. Specific IPs are allowed to browse the internet
2. Specific IPs are allowed to use Remote Desktop Connection to Head Office but not allowed to browse the internet

How should I do this trick.

thanks in advance

0
Comment
Question by:Sandy Kalugdan
  • 2
  • 2
4 Comments
 
LVL 40

Expert Comment

by:jlevie
ID: 11982474
What you'll want to do is to use a default deny stance for the FORWARD chain and explicitly permit those IP's in category (1) to FORWARD to anywhere. For the users in category (2) you'll want to explicitly permit FORWARD only to the head office IP(s).
0
 
LVL 3

Author Comment

by:Sandy Kalugdan
ID: 11982646
#I did this

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

#enabled this
echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#i want to allow only 192.168.0.250 to browse the net
iptables -A INPUT -s 192.168.0.250 -d 0.0.0.0/0 -j ACCEPT
iptables -A FORWARD -s 192.168.0.250 -j ACCEPT

#Disallow this IP from browsing but be able to connect to the #headoffice's IP
iptables -A INPUT -s 192.168.0.251 -d <IP addr> -j ACCEPT
iptables -A FORWARD -s 192.168.0.251 -j ACCEPT


what do you think of this?
0
 
LVL 40

Accepted Solution

by:
jlevie earned 125 total points
ID: 11983071
If you examine the packet flow diagram shown at http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-6.html you'll see that the INPUT chain rules are meaningless as far as access to Internet hosts.  That means that you'd want rules like:

#i want to allow only 192.168.0.250 to browse the net
iptables -A FORWARD -s 192.168.0.250 -d 0.0.0.0/0 -j ACCEPT

#Disallow this IP from browsing but be able to connect to the #headoffice's IP
iptables -A FORWARD -s 192.168.0.251-d <IP addr>  -j ACCEPT
0
 
LVL 3

Author Comment

by:Sandy Kalugdan
ID: 11993554
jlevie,
thanks for pointing out the diagram. actually, it is the one who answered my question.

you really are one of the best in linux security!

good day!
0

Featured Post

Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
Fine Tune your automatic Updates for Ubuntu / Debian
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question