I have a Linux PC I would like to use as a firewall. I have configured the router part of it:

1] enabled packet forwarding in the sysctl.conf file

2] set up NAT with the MASQUERADE option because my Internet connection is configured via DHCP

However, I set the following rules in iptables:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

I then save this to my /etc/sysconfig/iptables file and started iptables, /etc/init.d/iptables start

I dont understand how I am still able to connect to the Internet from another PC behind the firewall.

---------------- ----------- ------------ ------------------
| other pc |-----------| switch |-----------| firewall |-------| DSL modem |
---------------- ----------- ------------ ------------------

my first ASCII art ... thanks in advance ...

The default policy is for any packet that doesn't match any other rule. So you can set the default to DROP and still have internet access as long as those aren't your only rules.

here is the iptables file:

*filter
:INPUT DROP [2:120]
:FORWARD DROP [0:0]
:OUTPUT DROP [3:180]
COMMIT
# Completed on Thu Nov 6 23:09:16 2003
# Generated by iptables-save v1.2.7a on Thu Nov 6 23:09:16 2003
*nat
:PREROUTING ACCEPT [18:2025]
:POSTROUTING ACCEPT [49:3012]
:OUTPUT ACCEPT [97:6731]
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT

are you saying that *nat is the problem since it is set to accept prerouting, postrouting and output

Thanks

check all your iptables rules

#iptables -nL --line-numbers

you might want to try flushing all the tables first too.

I think you didn't add the flushing rule so your iptables will still read your old conf.

Try to add this few line above your default policy

iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

It will flush your existing rule and replace with your new one

If all fails and you get a bit frustrated with it, there is a easier way out of it. There are some great firewall distros out there, i am using one called IPCOP.

I´ve been running it for about a year now and it works well. It will install and format the drive and it´s pretty easy to configure. You´ll be up and running in no time at all.

There are also many firewall scripts available for you to try till you find one that fits your needs. Check out www.linuxguruz.com/iptables