I have a Linux 3.10 machine functioning as a NAT router between the wlan0
LAN and the eth0
WAN. I would like to allow all communication between machines on the LAN (they are trustworthy) and allow them to connect outward as much as they please, but disallow all unsolicited inbound traffic to both the router and the NATted machines.
I would also like to block all outbound multicast traffic from both the router and the LAN machines, as the LAN administrator has yelled* at me for multicast traffic from my machine before.
My iptables.rules
file looks like this:
# Generated by iptables-save v1.4.21 on Sun Apr 20 21:38:37 2014
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [23:2184]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i wlan0 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -m pkttype --pkt-type multicast -j DROP
COMMIT
# Completed on Sun Apr 20 21:38:37 2014
# Generated by iptables-save v1.4.21 on Sun Apr 20 21:38:37 2014
*nat
:PREROUTING ACCEPT [1643:178375]
:INPUT ACCEPT [1:60]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Sun Apr 20 21:38:37 2014
How do I modify it so that LAN clients (and the router!) can communicate with each other? Does the OUTPUT
rule filter all multicast leaving for the WAN like I want?
*not actually yelled but close enough
-m state --state RELATED,ESTABLISHED -j ACCEPT
rule does.)