How to I configure iptables for both IP masquerading and firewalling at the same time?

Question

I have a host that acts as a gateway for routing a home network to Internet. IP Masquerading has been enabled for months now and the system has worked fine.

How do I configure it to function also as a firewall? Any conditions I put on traffic in the FORWARD chain just dont work.

For example

-A FORWARD -i eth1 -p tcp -j ACCEPT

Just drops all TCP traffic from routing, instead of just restricting it to traffic originating from eth1. Also...

 -A FORWARD -s 192.168.2.0/24 -p tcp -j ACCEPT

...doesn't just allow TCP traffic from the 192.168.2.0 subnet, the moment I apply the rule all TCP traffic stops routing.

I have been unable to find any clear documentation on packet mangling with masquerade, or on how to ditch masquerade and instead use SNAT.

• eth0 is external interface, on same subnet as DSL router
• eth1 is internal interface, with all my hosts working fine on DHCP

How do I configure iptables to do both IP masquerading and firewalling?

# Generated by iptables-save v1.4.21 on Thu Oct 29 12:48:19 2015
*nat
:PREROUTING ACCEPT [10859:2328892]
:INPUT ACCEPT [1002:126271]
:OUTPUT ACCEPT [1256:91484]
:POSTROUTING ACCEPT [638:43890]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Oct 29 12:48:19 2015
# Generated by iptables-save v1.4.21 on Thu Oct 29 12:48:19 2015
*filter
:INPUT ACCEPT [5:803]
:FORWARD ACCEPT [127:18532]
:OUTPUT ACCEPT [5:431]
-A INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT -m comment --comment "HTTP Serve eth1"
-A INPUT -i eth1 -p tcp -m tcp --dport 443 -j ACCEPT -m comment --comment "SSH Serve eth1"
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT -m comment --comment "ssh on eth1"
-A INPUT -i eth0 -p tcp -m tcp --dport 53 -j DROP -m comment --comment "drop dns from eth0"
-A INPUT -p icmp -j ACCEPT
-A INPUT -i eth0 -j DROP
-A INPUT -i eth1 -j REJECT
-P INPUT DROP
-A FORWARD -p tcp -j ACCEPT -m comment --comment "all tcp from internal"
-A FORWARD -p udp -j ACCEPT -m comment --comment "all udp from internal"
-A FORWARD -p icmp -j ACCEPT
-P FORWARD DROP
-A OUTPUT -o eth1 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-P OUTPUT DROP
COMMIT
# Completed on Thu Oct 29 12:48:19 2015

Answer 1

iptables, and networking in general, is more complicated than you're giving it credit for.

So let's say you only do this, hoping to enable all outgoing traffic from internal eth1, as in your first line:

-A FORWARD -i eth1 -p tcp -j ACCEPT
-P FORWARD DROP

Where this breaks is that all connections and traffic is 2-way. FORWARD is processing all traffic that's not targeting the router (INPUT) or sourced from the router (OUTPUT). So FORWARD gets both your outbound tcp traffic initiating connection (which your rule allows) and all the replies attempting to acknowledge that connection and pass traffic back (which since you're dropping everything else that doesn't match, would require a new rule to permit).

This is where iptables gets very complicated, very quickly, because to set up a rule for every potential packet in both directions is crazy. It starts to get simpler if the first rule is always to allow traffic over established connections using -m state --state ESTABLISHED, as you started to use over in your other question sorting out your NAT problem. That will let you just write rules for connections you want to allow to start. It may also be helpful to sort incoming and outgoing connections into their own rules (unless you're only worried about outgoing), as in below:

#setup
-N outbound
-N inbound
#design
-A FORWARD -m state --state ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j inbound
-A FORWARD -i eth1 -o eth0 -j outbound
-P FORWARD DROP
#allow outgoing web access
-A outbound -p tcp -m tcp --dport 80,443 -j ACCEPT
#and nothing else
-A outbound DROP
#etc....