I have a machine that has two interfaces, eth0 and eth1, eth0 facing the INTERNET and eth1 facing DMZ.

I understand OUTPUT and INPUT with regards to eth0 if defined as:

iptables -A INPUT  -i eth0 -j eth0_input
iptables -A OUTPUT -i eth0 -j eth0_output

But I am a little unsure about the forward chain if defined as

iptables -A FORWARD -i eth0 -j eth0_forward

I never came along the case where I had to think about eth1 with respect to eth0 and the forward chain BUT this morning as in 99.99% (it seems) of the cases it just routes the packets towards the machines that are behind eth1.

Is the eth1 interface part of eth0_input and eth0_output or is it part of eth0_forward?



I believe you are asking the wrong question. eth1 interface is not part of eth0_input, and eth0_output is not part of eth0_forward - although they may be related in your configuration

  • eth0 and eth1 are interfaces.
  • eth0_input, eth0_output and eth0_forward are constructs created by your configuration rules, and while descriptive are entirely arbitrary.

Rules are separate to interfaces, although they interact with them.

In general -

  • Packets destined to the local machine are handled by the INPUT chain. Relatedly, Packets originating from the local machine (ignoring NAT) are handled with the OUTPUT chain.

  • Packets from other machines behind the router go through the FORWARD chain.

You will most likely find that eth0_forward chain has been used to control what servers & ports are exposed to the Internet, ie traffic originating from eth0 will be traffic from the world, and should only be allowed if - It corresponds to an outbound stream (ie caught by an earlier ESTABLISHED,RELATED rule) or is to a known port on a known system - in which case it should be allowed or rejected before it reaches eth1. THE RULE AS WRITTEN DEALS WITH TRAFFIC FROM THE WORLD BEFORE IT GETS TO THE LAN SIDE OF THE FIREWALL.

  • So eth1 is part of the LOCAL machine and hence part of the INPUT and OUTPUT chains? – Jobst Nov 13 '17 at 22:59
  • 1
    Sort of. eth1 is an interface known to the local machine. Its not part of the Input or Output chains - the kernel directs the packet through those chains. It could equally be a tunnel, PPP or VLAN. It is not part of the Input or Output chains. When a packet comes in to eth1 and its destination is known to the local machine, the kernel routes it through the INPUT chain. When a packet originating from the local machine goes out eth1 it is sent through the OUTPUT chain . – davidgo Nov 13 '17 at 23:03
  • Been using iptables for a long time, never thought about the second interface of a two-homed machine as - really - eth0 is the firewall and eth1 is just "a thing" to route the packets to/from the computers behind it. Always thought the second interface of a dual-homed machine would be included by the forward chain ... maybe the netfilter team has to include diagrams about multi-homed machines - or maybe it's just me. – Jobst Nov 13 '17 at 23:56
  • Mmmmh "fundamentally flawed" and "single homed". I can have more than one INPUT chain (one for each interface), I can have two OUTPUT chains (one for each interface) and I can have two FOWARD chains (again one for each interface), also iptables does not care whether its INTERNET or LAN, from the hosts point of few I can still block/unblock each network (if I wish to do so).\ – Jobst Nov 14 '17 at 1:16
  • I'm not wanting to have an argument - I answer this on the assumption you are asking the question to learn - you have 1 INPUT chain per table - so ignoring the Mangle table 1 INPUT chain. You can have multiple rules in a chain - thegeekstuff.com/2011/01/iptables-fundamentals With respect of multihomed and single homed, maybe the most intuitive answer is at pcmag.com/encyclopedia/term/47460/multihomed – davidgo Nov 14 '17 at 1:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.