Welcome to the most active Linux Forum on the web.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 05-02-2010, 02:20 PM   #1
LQ Newbie
Registered: May 2010
Distribution: Ubuntu
Posts: 5

Rep: Reputation: 0
Thumbs up Bridging firewall, how to block incoming traffic?

Im having problems with iptables not doing what i want

I have a Ubuntu computer set up as bridge between gateway and lan, with the lan connected to eth0 and gateway on eth1.

I'm trying to get it to basically block everything incoming except for the ports i specify (www etc.), but also allow outgoing traffic from the lan behind it. I've found, tried and modified som examples i found on the web, but still it wont block incoming traffic (ie, im still able to reach my webserver)

These are the rules im running now, and i can't figure out why it wont block incoming:


iptables -F
iptables -X

iptables -I INPUT -i eth1 -j DROP
iptables -I INPUT -i eth0 -j DROP
iptables -I OUTPUT -o eth1 -j REJECT
iptables -I OUTPUT -o eth0 -j REJECT

# connection tracking
iptables -I FORWARD -m state --state INVALID -j DROP
iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

# allow outgoing traffic
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# allow ping
iptables -A FORWARD -p icmp -i eth0 -o eth1 -j ACCEPT
# stop incoming
iptables -A FORWARD -i eth1 -o eth0 -j REJECT
iptables -S gives me
-A INPUT -i eth0 -j DROP
-A INPUT -i eth1 -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -p icmp -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -o eth0 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -o eth1 -j REJECT --reject-with icmp-port-unreachable
Any advice on what im doing wrong is appreciated

Last edited by zyprexa; 05-03-2010 at 11:23 AM.
Old 05-03-2010, 02:06 AM   #2
Registered: Apr 2009
Location: Perth, Australia
Distribution: Ubuntu/CentOS
Posts: 208

Rep: Reputation: 51
Because your eth0 and eth1 are in a bridge, they show up as br0 (or someting similar) to iptables. If you want to match packets inside the bridge using the physical interface the packets come from, you need to use the 'physdev' module.

Try this (untested, might be wrong on the physdev syntax)

iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP

# drop invalid
iptables -I FORWARD -m state --state INVALID -j DROP

# allow outgoing traffic
iptables -A FORWARD -m physdev --physdev-in eth0 --physdev-out eth1 -j ACCEPT

# allow related/established connections in
iptables -A FORWARD -m physdev --physdev-in eth1 --physdev-out eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Drop all other incoming traffic
iptables -A FORWARD -m physdev --physdev-in eth1 --physdev-out eth0 -j REJECT
Old 05-03-2010, 03:03 AM   #3
Registered: Mar 2009
Posts: 249

Rep: Reputation: 27
Use the physdev match extension. Your connection tracking match is backwards, you want to allow incoming traffic that matches.

What about protocols other than IPv4?
Old 05-03-2010, 11:23 AM   #4
LQ Newbie
Registered: May 2010
Distribution: Ubuntu
Posts: 5

Original Poster
Rep: Reputation: 0
Thanks guys, using physdev seems to solve my problem.


bridge, firewall, iptables, network

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Block all incoming mail traffic except certain addresses jennyzon Linux - Networking 1 01-13-2009 06:35 AM
Incoming traffic prioritize dorian33 Linux - Networking 8 10-26-2008 05:44 AM
Allow Incoming Traffic clarence1720 Mandriva 15 12-06-2004 11:26 PM
NOOB: Firewall how do I configure it to block all incoming info? PionexUser Linux - Security 1 11-19-2003 10:39 PM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 01:08 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration