iptables forward?

Bambi · 10-01-2003, 11:21 AM

I have a firewall connected to the internet -- two ethernet cards. Behind that I have a switch, my server and other computers.
I've read the iptables material and it is my impression that:

I will NOT be dealling at all with INPUT or OUTPUT, but with FORWARD exclusively and/or the -state stuff. This firewall is not just the software but an actual seperate computer.

I don't know why but I've never read any examples of INPUT OUTPUT set to deny, that is why I'm worried.

/bin/bash · 10-01-2003, 06:59 PM

It sounds to me like you need to look at the rc.firewall.txt or rc.DMZ.firewall.txt

Yes you will need to filter the INPUT, you want to protect the firewall itself. Usually the reason you would filter OUTPUT would be to block access to services or websites.

Bambi · 10-02-2003, 11:15 AM

Yes I have read that, but it may be my misinterpretation.
My setup has a server (mail, httpd, smb. etc.) behind the firewall. Just to be clear,: The firewall machine will NOT be doing anything but forwarding to the server or forwarding to the internet. So my understanding is:
IPTABLES -P INPUT DROP
IPTABLES -P OUTPUT DROP

iptables -t nat -A ...etc.

Am I misunderstanding this?