Solved

Iptables rule to allow communication to specific IPs

Posted on 2014-04-13
2
423 Views
Last Modified: 2014-04-13
Hi everyone!

I have a Linux firewall:

eth0 LAN
eth1 INTERNET
eth2 LAN2

I want to let LAN users use internet and ONLY specific computers on LAN2

I've tried this without luck, what am I doing wrong?


#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

iptables -A FORWARD -o eth0 -d 192.168.1.1 -j ACCEPT
iptables -A FORWARD -o eth0 -d 192.168.1.2 -j ACCEPT
iptables -A FORWARD -o eth0 -d 192.168.1.0/24 -j DROP

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCE                                   PT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Enable or disable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward
#echo 0 > /proc/sys/net/ipv4/ip_forward
0
Comment
Question by:ltpitt
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 27

Accepted Solution

by:
Nopius earned 500 total points
ID: 39997946
Hi. I hope 192.168.1.1, 192.168.1.2 - is IP addresses in LAN2, that you should keep open from LAN? If yes, try this code:

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Default policy - accept
iptables -P FORWARD  ACCEPT
# eth0 rules (LAN)
# allow only specific addresses in LAN2
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.1 -j ACCEPT
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.2 -j ACCEPT
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.0/24 -j REJECT
# Allow established connections
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT
# Always accept loopback traffic
# lo rules
iptables -A INPUT -i lo -j ACCEPT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

Open in new window

0
 
LVL 1

Author Closing Comment

by:ltpitt
ID: 39997986
Perfectly working!
0

Featured Post

Plug and play, no additional software required!

The ATEN UE3310 USB3.1 Gen1 Extender Cable allows users to extend the distance between the computer and USB devices up to 10 m (33 ft). The UE3310 is a high-quality, cost-effective solution for professional environments such as hospitals, factories and business facilities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Suggested Courses

631 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question