iptables with multiple NIC

sketch429 · 01-19-2011, 11:42 AM

hey, im trying to set up an iptables firewall.

my setup is as follows (netkit setup btw):

admin pc -- eth0 @ 192.168.1.161/24 --- lanA
-- eth1 @ 146.192.161.112/24 --- lanB
-- eth2 @ 10.10.121.116/24 --- lanC

lanA(intranet) -- database server @ 192.168.1.206
-- DNS @ 192.168.1.211

lanB -- gateway --eth0 @ 146.192.161.254
--eth1 @ 146.192.161.253
internet -- eth0 @ 146.192.161.113 ( purely for purposes of simulating internet traffic)

lanC -- web-server -- eth0 @ 10.10.121.211

I have iptables setup with default policies to DROP all traffic.

Now what i need to do is to allow intranet users (DB & DNS) access to web (tcp port 80) but deny any internet originating packets getting to the intranet.

i assume the use of state selecting (NEW,ESTABLISHED,RELATED) is to be used but i am at a loss as how to.

any help is greatly appreciated.

thanks

sketch

tsg · 01-19-2011, 12:23 PM

The -i and -o parameters allow you to select incoming and outgoing (respectively) traffic on particular interfaces.

Then:

Code:

iptables -A FORWARD -o eth1 -p tcp -s 192.168.1.0/24 --dport 80 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

will allow traffic to port 80 out on the external interface from the lanA subnet, and any related traffic back in.