Solved

Iptables rule to allow communication to specific IPs

Posted on 2014-04-13
2
418 Views
Last Modified: 2014-04-13
Hi everyone!

I have a Linux firewall:

eth0 LAN
eth1 INTERNET
eth2 LAN2

I want to let LAN users use internet and ONLY specific computers on LAN2

I've tried this without luck, what am I doing wrong?


#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

iptables -A FORWARD -o eth0 -d 192.168.1.1 -j ACCEPT
iptables -A FORWARD -o eth0 -d 192.168.1.2 -j ACCEPT
iptables -A FORWARD -o eth0 -d 192.168.1.0/24 -j DROP

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCE                                   PT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Enable or disable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward
#echo 0 > /proc/sys/net/ipv4/ip_forward
0
Comment
Question by:ltpitt
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 27

Accepted Solution

by:
Nopius earned 500 total points
ID: 39997946
Hi. I hope 192.168.1.1, 192.168.1.2 - is IP addresses in LAN2, that you should keep open from LAN? If yes, try this code:

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Default policy - accept
iptables -P FORWARD  ACCEPT
# eth0 rules (LAN)
# allow only specific addresses in LAN2
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.1 -j ACCEPT
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.2 -j ACCEPT
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.0/24 -j REJECT
# Allow established connections
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT
# Always accept loopback traffic
# lo rules
iptables -A INPUT -i lo -j ACCEPT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

Open in new window

0
 
LVL 1

Author Closing Comment

by:ltpitt
ID: 39997986
Perfectly working!
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question