Home / server / Questions / 244767
Accepted
nixnotwin
Asked: 2011-03-09 09:00:18 +0800 CST

Enable iptables on one interface

  • 772

I want iptables to filter only one interface, eth0, which is facing WAN. How can this be done? And I want to keep ftp and ssh ports open on eth0.

iptables

4 Answers

  1. Best Answer

    So for all interfaces but one you want to accept all traffic, and on eth0 you want to drop all incoming traffic except ftp and ssh.

    First, we could set a policy of accepting all traffic by default.

    iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

    Then, we could reset your firewall rules.

    iptables -F

    Now we could say that we want to allow incoming traffic on eth0 that is a part of a connection we already allowed.

    iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

    Also that we want to allow incoming ssh connections on eth0.

    iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

    But that anything else incoming on eth0 should be dropped.

    iptables -A INPUT -i eth0 -j DROP

    For slightly more depth see this CentOS wiki entry.

    FTP is a trickier than ssh since it can use a random port, so see this previous question.

    • 35

  2. Something like this should do the job: 

    iptables -A INPUT -i eth1 -p all -j DROP
iptables -A INPUT -i eth0 -p all -j ACCEPT
    • 8

  3. It is very simple when you make an iptables rule then you have to specify the interface. The option to specify the LAN card on which iptables should work is -i

    Following rules can give you a good example

    iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 -j REJECT --reject-with tcp-reset

    Last rule is to reject any other packet which does not match the first 2 rules. All rules in iptables are executed in the given order, so the rule to reject packets is always the last.

    • 4

  4. The option to specify an interface in your iptables rule is -i, e.g.: -i eth0.

    • 4