Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Iptables rule to allow communication to specific IPs

Posted on 2014-04-13
2
Medium Priority
?
428 Views
Last Modified: 2014-04-13
Hi everyone!

I have a Linux firewall:

eth0 LAN
eth1 INTERNET
eth2 LAN2

I want to let LAN users use internet and ONLY specific computers on LAN2

I've tried this without luck, what am I doing wrong?


#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

iptables -A FORWARD -o eth0 -d 192.168.1.1 -j ACCEPT
iptables -A FORWARD -o eth0 -d 192.168.1.2 -j ACCEPT
iptables -A FORWARD -o eth0 -d 192.168.1.0/24 -j DROP

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCE                                   PT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Enable or disable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward
#echo 0 > /proc/sys/net/ipv4/ip_forward
0
Comment
Question by:ltpitt
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 27

Accepted Solution

by:
Nopius earned 2000 total points
ID: 39997946
Hi. I hope 192.168.1.1, 192.168.1.2 - is IP addresses in LAN2, that you should keep open from LAN? If yes, try this code:

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Default policy - accept
iptables -P FORWARD  ACCEPT
# eth0 rules (LAN)
# allow only specific addresses in LAN2
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.1 -j ACCEPT
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.2 -j ACCEPT
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.0/24 -j REJECT
# Allow established connections
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT
# Always accept loopback traffic
# lo rules
iptables -A INPUT -i lo -j ACCEPT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

Open in new window

0
 
LVL 1

Author Closing Comment

by:ltpitt
ID: 39997986
Perfectly working!
0

Featured Post

Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Suggested Courses

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question