Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Iptables rule to allow communication to specific IPs

Posted on 2014-04-13
2
408 Views
Last Modified: 2014-04-13
Hi everyone!

I have a Linux firewall:

eth0 LAN
eth1 INTERNET
eth2 LAN2

I want to let LAN users use internet and ONLY specific computers on LAN2

I've tried this without luck, what am I doing wrong?


#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

iptables -A FORWARD -o eth0 -d 192.168.1.1 -j ACCEPT
iptables -A FORWARD -o eth0 -d 192.168.1.2 -j ACCEPT
iptables -A FORWARD -o eth0 -d 192.168.1.0/24 -j DROP

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCE                                   PT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Enable or disable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward
#echo 0 > /proc/sys/net/ipv4/ip_forward
0
Comment
Question by:ltpitt
2 Comments
 
LVL 27

Accepted Solution

by:
Nopius earned 500 total points
ID: 39997946
Hi. I hope 192.168.1.1, 192.168.1.2 - is IP addresses in LAN2, that you should keep open from LAN? If yes, try this code:

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Default policy - accept
iptables -P FORWARD  ACCEPT
# eth0 rules (LAN)
# allow only specific addresses in LAN2
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.1 -j ACCEPT
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.2 -j ACCEPT
iptables -A FORWARD -o eth2 -i eth0 -d 192.168.1.0/24 -j REJECT
# Allow established connections
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT
# Always accept loopback traffic
# lo rules
iptables -A INPUT -i lo -j ACCEPT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

Open in new window

0
 
LVL 1

Author Closing Comment

by:ltpitt
ID: 39997986
Perfectly working!
0

Featured Post

Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question