1

I have a machine that has two interfaces, eth0 and eth1, eth0 facing the INTERNET and eth1 facing DMZ.

I understand OUTPUT and INPUT with regards to eth0 if defined as:

iptables -A INPUT  -i eth0 -j eth0_input
iptables -A OUTPUT -i eth0 -j eth0_output

But I am a little unsure about the forward chain if defined as

iptables -A FORWARD -i eth0 -j eth0_forward

I never came along the case where I had to think about eth1 with respect to eth0 and the forward chain BUT this morning as in 99.99% (it seems) of the cases it just routes the packets towards the machines that are behind eth1.

Is the eth1 interface part of eth0_input and eth0_output or is it part of eth0_forward?

thanks

Improve this question

2 Answers 2

Reset to default
2

I believe you are asking the wrong question. eth1 interface is not part of eth0_input, and eth0_output is not part of eth0_forward - although they may be related in your configuration

  • eth0 and eth1 are interfaces.
  • eth0_input, eth0_output and eth0_forward are constructs created by your configuration rules, and while descriptive are entirely arbitrary.

Rules are separate to interfaces, although they interact with them.

In general -

  • Packets destined to the local machine are handled by the INPUT chain. Relatedly, Packets originating from the local machine (ignoring NAT) are handled with the OUTPUT chain.

  • Packets from other machines behind the router go through the FORWARD chain.

You will most likely find that eth0_forward chain has been used to control what servers & ports are exposed to the Internet, ie traffic originating from eth0 will be traffic from the world, and should only be allowed if - It corresponds to an outbound stream (ie caught by an earlier ESTABLISHED,RELATED rule) or is to a known port on a known system - in which case it should be allowed or rejected before it reaches eth1. THE RULE AS WRITTEN DEALS WITH TRAFFIC FROM THE WORLD BEFORE IT GETS TO THE LAN SIDE OF THE FIREWALL.

Improve this answer
6
  • So eth1 is part of the LOCAL machine and hence part of the INPUT and OUTPUT chains?
    – Jobst
    Nov 13, 2017 at 22:59
  • 1
    Sort of. eth1 is an interface known to the local machine. Its not part of the Input or Output chains - the kernel directs the packet through those chains. It could equally be a tunnel, PPP or VLAN. It is not part of the Input or Output chains. When a packet comes in to eth1 and its destination is known to the local machine, the kernel routes it through the INPUT chain. When a packet originating from the local machine goes out eth1 it is sent through the OUTPUT chain .
    – davidgo
    Nov 13, 2017 at 23:03
  • Been using iptables for a long time, never thought about the second interface of a two-homed machine as - really - eth0 is the firewall and eth1 is just "a thing" to route the packets to/from the computers behind it. Always thought the second interface of a dual-homed machine would be included by the forward chain ... maybe the netfilter team has to include diagrams about multi-homed machines - or maybe it's just me.
    – Jobst
    Nov 13, 2017 at 23:56
  • Mmmmh "fundamentally flawed" and "single homed". I can have more than one INPUT chain (one for each interface), I can have two OUTPUT chains (one for each interface) and I can have two FOWARD chains (again one for each interface), also iptables does not care whether its INTERNET or LAN, from the hosts point of few I can still block/unblock each network (if I wish to do so).\
    – Jobst
    Nov 14, 2017 at 1:16
  • I'm not wanting to have an argument - I answer this on the assumption you are asking the question to learn - you have 1 INPUT chain per table - so ignoring the Mangle table 1 INPUT chain. You can have multiple rules in a chain - thegeekstuff.com/2011/01/iptables-fundamentals With respect of multihomed and single homed, maybe the most intuitive answer is at pcmag.com/encyclopedia/term/47460/multihomed
    – davidgo
    Nov 14, 2017 at 1:32
0

I don't undertand the changes you need in the rules to solve your problem, since your question is about chains being part of interfaces. They are not.

If just to answer your question, the first part of the answer by davidgo is right on point. It seems a case of the xy-probem.

But to expand on it,

  • eth0_input, eth0_output and eth0_forward: they are just user-defined named chains

You can think of them as just a "jumper". Lets say instead of calling them eth0_input and so on, you call them input0 and alike.

Then you can have rules like:

iptables -A INPUT  -i eth0 -j input0
iptables -A OUTPUT -i eth0 -j output0
iptables -A FORWARD -i eth0 -j forward0
iptables -A input0 --match-something --do-something
iptables -A output0 --match-something --do-something
iptables -A forward0 --match-something --do-something

You don't need those. You could as well not use them and just state directly the same things without input0, output0 and forward0. For example:

iptables -A INPUT  -i eth0 --match-something --do-something
iptables -A OUTPUT -i eth0 --match-something --do-something
iptables -A FORWARD -i eth0 --match-something --do-something

I hope this approach could clarify what was that you needed to do.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .