I want to create a gateway firewall for my network . I want to block all the internal traffic on gateway and allow it from two computers only . On gateway

--> eth0 is network card in gateway PC that connects to the Internet

--> eth1 is network card in gateway PC that connects to my internal network

I want to accept traffic from only two ip from internal network and forward them from eth0 to main internet and block all rest traffic.

Allow ip and

My rules are as follows.

iptables -P INPUT DROP 
iptables -P OUTPUT DROP    
iptables -P FORWARD DROP    
iptables -I INPUT -s -j ACCEPT    
iptables -I INPUT -s -j ACCEPT    
iptables -I OUTPUT -s -j ACCEPT    
iptables -I OUTPUT -s -j ACCEPT

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE    
iptables --append FORWARD --in-interface eth1 -j ACCEPT

echo "1" > /proc/sys/net/ipv4/ip_forward

Please any one can correct my rules .

  • Perhaps you should tell us what is not working for you – fpmurphy Jun 10 '14 at 0:05
  • Perhaps you mean -d for destination (instead of -s for source) on the two OUTPUT rules? – BenjiWiebe Jun 12 '14 at 0:49

You should apply rules to the FORWARD chain:

iptables -I FORWARD -s -j ACCEPT    
iptables -I FORWARD -s -j ACCEPT

I suspect you would like to accept the response:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.