0

I have an ubuntu server configured as a gateway router with eth0 (ext connected to a dsl router) and eth1 (internal network)

I have Source NAT enabled, to share the external IP with all internal hosts, also the ubuntu server is DHCPing to clients on eth1 only)

In building an iptables firewall on the ubuntu box, if I try and specify subnets (eg internal at 192.168.2.0) or interfaces (eth1) then all traffic seems to jump to the default FORWARD policy (DROP). If I leave off any arguments (eg iptables -A FORWARD -p icmp -j ACCEPT) then that protocol will work and traverse interfaces no problem.

This problem also applies to the INPUT chain, so if I try and specify ICMP ACCEPT from 192.168.2.0/24 it will time out, but if I just specify to accept ICMP I can then ping the eth1)

I am attaching the rules for forwarding below... I have spent a good deal of time trying to understand the issue but to no avail. Could anyone advise on what fundamental error I am making here?)

-A FORWARD -p tcp -j ACCEPT -m comment --comment "all tcp from internal"
-A FORWARD -p udp -j ACCEPT -m comment --comment "all udp from internal"
-A FORWARD -i eth1 -p icmp -j ACCEPT

(above does not work)

-A FORWARD -p icmp -j ACCEPT

(protocol alone specified, and it works)

-A FORWARD -p icmp -j REJECT
-P FORWARD DROP
2
  • The formatting on this is a bit unclear, where it says (above does not work) it is referring explicitly to the -A FORWARD -i eth1 -p icmp -j ACCEPT line, not the preceding two, which both work fine. Oct 30, 2015 at 21:50
  • From my own research it appears that my error might be to do with NATing, and that NATing would require additional PREROUTING/POSTROUTING arguments for each of the rules that fail. What confuses me though is why my rules are still working on a protocol by protocol basis, just not when any hosts or interfaces are addtionally specified... Oct 31, 2015 at 8:48

0

You must log in to answer this question.

Browse other questions tagged .