I'm new to IPtables and am attempting to configure a firewall for a home lan.
I have a linux server and 2 workstations. The server has 2 nics eth0 to the internet and eth1 as the internal LAN. The workstations receive there IP's from DHCPd on the server.

I want to allow all workstations to have access to the internet via eth0 on the server.
I want to allow access FROM the internet to port XXX on workstation 192.168.1.50.
I want to enable NAT

My current iptables looks like this:
#!/bin/sh
# Cleanup old rules # All the time firewall is in a secure, closed state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables --flush # Flush all rules, but keep policies
iptables --delete-chain
## Workstation###
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -A INPUT -i lo --source 127.0.0.1 --destination 127.0.0.1 -j ACCEPT
iptables -A INPUT -m state --state "ESTABLISHED,RELATED" -j ACCEPT
####### HOLES #######
##Allow access from LAN
iptables -A INPUT -i lo -j ACCEPT #local loopback device.
iptables -A INPUT -i eth1 -s 192.168.1.0/24 -j ACCEPT #Allow any ip address in the 192.168.1.0 subnet.
### Allow external access to SAMBA
iptables -I INPUT -i eth0 -p tcp --dport 139 -s xx.xx.xxx.227 -j ACCEPT
iptables -I INPUT -i eth0 -p tcp --dport 445 -s xx.xx.xxx.227 -j ACCEPT
iptables -I INPUT -i eth0 -p udp --dport 138 -s xx.xx.xxx.227 -j ACCEPT
iptables -I INPUT -i eth0 -p udp --dport 137 -s xx.xx.xxx.227 -j ACCEPT
echo "External access to SAMBA for xx.xx.xxx.227"
###Allow external access to SQL on port 3306 from xx.xx.xx.xxx
iptables -I INPUT -i eth0 -p tcp --dport 3360 -s xx.xx.xxx.227 -j ACCEPT
iptables -I INPUT -i eth0 -p udp --dport 3360 -s xx.xx.xxx.227 -j ACCEPT
echo "MySQL granted for xx.xx.xxx.227"
## Stop Ping ##
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j DROP
#echo "Ping stopped"
## Stop Ping end ##
##################### Edit above
iptables -A INPUT -j LOG -m limit --limit 40/minute
iptables -A INPUT -j DROP
# Save
iptables-save > /etc/sysconfig/iptables
echo "$0: Done."

good luck

After running the script I lose connection with my workstations. I think the problem is in my own:

##Allow access from LAN
iptables -A INPUT -i lo -j ACCEPT #local loopback device.
iptables -A INPUT -i eth1 -s 192.168.1.0/24 -j ACCEPT #Allow any ip address in the 192.168.1.0 subnet.

If I write ' iptables -A INPUT -i eth1 -j ACCEPT ' then its OK. So the problem must be with the '192.168.1.0/24'. My subnet info in dhcpd.conf is:

ddns-update-style ad-hoc;

subnet 192.168.1.0 netmask 255.255.255.128 {
range 192.168.1.11 192.168.1.50;
option routers 192.168.1.1;
option domain-name-servers 193.xxx.xxx.xxx, 194.xxx.xxx.xxx;
max-lease-time 86400000;
min-lease-time 900;
default-lease-time 864000;
}

So I'm missing the problem here.? How do I allow the subnet 192.168.1.0?

sorry im -edit- NOT good at dhcpd thing. actually u can check /etc/services file to see ports of dhcp and allow dhcpd ports. if i remeber correctly those ports are tcp/udp 67 . so u can try :

iptables -A INPUT -i eth1 -p tcp --dport 67 -j ACCEPT
iptables -A INPUT -i eth1 -p udp --dport 67 -j ACCEPT
iptables -A INPUT -i eth1 -s 192.168.1.0/255.255.255.0 -j ACCEPT

and what about the POSTROUTING/PREROUTING rules that i suggested, do they work?

good luck.

Is'nt there an allow all input/output between eth0 and eth1?

I do not suggest allowing samba external access. Windows networking is very insecure and could be a avenue to nasty stuff.

I've compiled SAMBA with SSL and use ALLOW/DENY hosts.