Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hello to all :) I need a little help with creating a rules. Im starting to learn iptables and firewalls but I have some questions. I need to allow HTTP communication only from PcA to PcB./ My code is:

iptables  -A INPUT -s PcA's_IP -d PcB's_IP --sport 80 -j ACCEPT

iptables     -A INPUT -d PcB's_IP --dport 80 -jDROP

My question here is whether I should use INPUT or FORWARD.

Then if I want to allow the rest traffic what should I write ? Maybe:

iptables -A INPUT -P ACCEPT

I am writing into the INPUT file of the PcB. I would be very pleased if someone help me. I've been reading a lot but there are only complex examples that are hard for me to understand.

share|improve this question

migrated from May 12 '13 at 20:01

This question came from our site for professional and enthusiast programmers.

You may want to look at a tool which builds the rules for you, then examine the rules to understand what they do. There are a few standard rules which should be enabled to allowed. I prefer Shorewall, which is well documented and I find easy to use for simple and complex setups. It also has good example configuration to use as a starting point.

share|improve this answer

One crucial thing to understand with iptables is that it will go through the rules in sequential order, so your question cannot be answered without knowing what are all the other existing rules in your iptables configuration. This you can see for individual chains with "iptables -vL chain" (f.ex. iptables -vL INPUT), or for all chains with "iptables-save".

There is also one implicit rule in the three default chains (INPUT, OUTPUT, and FORWARD); that is the chain policy, which defines what happens to packets that do not match the criterias of any of the existing rules in that chain. From your example, it seems you've already realized this.

As of use of INPUT as opposed to FORWARD, use INPUT. FORWARD is meant only when forwarding the packets to other machines (i.e. when the machine with iptables is acting as firewall for other machines.

To sum these up, and to get back to your original question, the rules you wrote seem almost ok (I think there should be a "-p tcp" within the flags, to indicate that the rules concern tcp protocol. And of course, if there are other rules we don't know about, then they might well block the http traffic before it hits these rules. So, in iptables, the first terminal rule (i.e. rule with ACCEPT, REJECT or DROP) that has criteria matching to a packet will process that packet, and no other rules after it in the same chain have no effect in processing.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .