I have iptables running on a host (acting as a firewall) in a Linux namespace with only one network interface: h2-eth1 (has an IP and MAC address)
I have set up my switch to forward all packets to the firewall, and the packets returned from the firewall to the internal network. Now, I proceed to do a simple sanity check to see if everything is working. I run these commands on the firewall:
$sudo bash -c 'echo 1 > /proc/sys/net/ipv4/ip_forward' $iptables -P INPUT ACCEPT $iptables -P FORWARD DROP $iptables -P OUTPUT ACCEPT $iptables -F INPUT $iptables -F FORWARD $iptables -F OUTPUT $iptables -F -t nat $iptables -A FORWARD -i h2-eth1 -o h2-eth1 -j ACCEPT
Now, I ping an internal host from outside. I see ICMP packets going to the firewall but none coming back from it. So, I ran
iptables -nvL on the firewall and I see all tables (INPUT, OUTPUT, and FORWARD) have packet count 0. So, the packets are not reaching iptables because they don't match the IP address of the NIC? How do I correct this?