Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working with a linux based UTM appliance and have some disagreement with the client on the operation. THere is a standard GUI to configure port forwards in the firewall but for some reason he thinks the following rules are required.

-s -d -j ACCEPT
-s -d -j ACCEPT
-s -d -j ACCEPT

very dirty network topology and yes I know its awful

Hosted cloud VM's [public IP example] [Microsoft TMG]/23  [cloud gateway]/23 [cloud edge?]/30
---------------------------------------------------------------------- [site cisco 2921 external]/30   [site cisco 2921 internal]/30
----------------------------------------------------------------------   [UTM gateway]/30 (seconary IP   [UTM gateway internal]/23 (secondary IP

it is the most awful convoluted configuration but it is what I have to work with. Hopefully that gives some more perspective. I just need to define what the IPTABLES rule above is doing.

I believe it is just opening all incoming traffic but the subnets are wrong as you can see from the CIDR notation at the end of the network topology. THe other thing is the destination setting, traffic comes from the public IP or the TMG not the CISCo?

My networking abilities are not as good as what I would like but I am learning and someone could let me know what those entries are allowing and if they actually work that would be so appreciated.

HERE is a diagram to help - will give better idea of network. Network Diagram

share|improve this question
The first 3 contain non-routeable ip address that won't work on the internet, only internally. – cybernard Oct 12 '13 at 4:48
the -s is source and the -d is destination – cybernard Oct 12 '13 at 4:48
So all traffic between the specified subnets is ACCEPTed. Any drop rules for these addresses/subnets that come after these lines will never do anything. Other ip address can still be blocked normally. – cybernard Oct 12 '13 at 4:54
The rules are position sensitive so these rules out of context may or may not function as desired. Something in line 1 could block the traffic and these rules could do nothing. Accepting the internal traffic is not a bad thing as long as they are not likely to get viruses or etc. Security experts recommend only allowing the port necessary for the computers to function and block the rest. The public IP is the one that should be the most blocked. Place rules to allow the few ports you need and drop the rest of the incoming traffic. – cybernard Oct 12 '13 at 5:06
added a link to a diagram so it may be a little clearer. With the network the way it is, its hard to do. My question is, with this network layout, are these rules doing anything at all? -s or source is going to be the TMG server as it has to port forward from the external but the dule in there is to generic and will not forward anything just allow it through – Robert Wilde Oct 12 '13 at 6:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.