Sample iptable Command


Putting this all together creates a firewall that can protect your network.   Assume that we have a Linux router attached to a perimeter network with the address 172.16.12.254 on interface eth0 and to an external network with the address 192.168.6.5 on interface eth1.   Further assume that the perimeter network contains only a sendmail server and an Apache server.

 

  iptables -F INPUT

  iptables -F FORWARD

  iptables -A INPUT -i eth1 -j DROP

  iptables -A FORWARD -i eth1 -s 172.16.0.0/16 -j DROP

  iptables -A FORWARD -o eth1 -d 172.16.0.0/16 -j DROP

  iptables -A FORWARD -d 172.16.12.1 25 -j ACCEPT

  iptables -A FORWARD -d 172.16.12.6 80 -j ACCEPT

  iptables -A FORWARD -j DROP



Note

  • 1st two(2) commands use the -F option to clear the chain we plan to work with
  • 3rd line, drops any packets from the external network that are bound for a process running locally on the Linux router
  • 4th and 5th line, drop packets that are being routed to the external world using an internal address
  • 6th and 7th line, are basically identical.   They accept packets if the destination and port are the correct destination and port for a specific server.   port 25 is SMTP and port 80 is the HTTP port
  • 8th line, this is the last line and it just reject all other traffic