I have an ubuntu server configured as a gateway router with eth0 (ext connected to a dsl router) and eth1 (internal network)
I have Source NAT enabled, to share the external IP with all internal hosts, also the ubuntu server is DHCPing to clients on eth1 only)
In building an iptables firewall on the ubuntu box, if I try and specify subnets (eg internal at 192.168.2.0) or interfaces (eth1) then all traffic seems to jump to the default FORWARD policy (DROP). If I leave off any arguments (eg iptables -A FORWARD -p icmp -j ACCEPT
) then that protocol will work and traverse interfaces no problem.
This problem also applies to the INPUT chain, so if I try and specify ICMP ACCEPT from 192.168.2.0/24 it will time out, but if I just specify to accept ICMP I can then ping the eth1)
I am attaching the rules for forwarding below... I have spent a good deal of time trying to understand the issue but to no avail. Could anyone advise on what fundamental error I am making here?)
-A FORWARD -p tcp -j ACCEPT -m comment --comment "all tcp from internal"
-A FORWARD -p udp -j ACCEPT -m comment --comment "all udp from internal"
-A FORWARD -i eth1 -p icmp -j ACCEPT
(above does not work)
-A FORWARD -p icmp -j ACCEPT
(protocol alone specified, and it works)
-A FORWARD -p icmp -j REJECT
-P FORWARD DROP