Firewall functions: IPTABLES
U
SER
G
UIDE
193
# In entering the router and in transit accept
# only packets belonging to
# existing sessions
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Accept packets in transit to the server
iptables -A FORWARD -p tcp -d 192.168.1.2
–
-dport 80
–
j ACCEPT
# D-NAT from public address to server
iptables -t nat -A PREROUTING -p tcp -i atm0 -d 85.34.147.17 --dport 80 -j DNAT --to 192.168.1.2
# S-NAT towards outside
iptables
–
t nat
–
A POSTROUTING
–
o atm0
–
s 192.168.0.0/24
–
j SNAT --to-source 85.34.147.18
iptables -t nat -A POSTROUTING -o atm0 -s 192.168.1.2 -j SNAT --to 85.34.147.17
# Deny access to host 217.201.2.3
iptables
–
A FORWARD
–
o atm0
–
s 192.168.0.0/24
–
d 217.201.2.3
–
j LOG
iptables
–
A FORWARD
–
o atm0
–
s 192.168.0.0/24
–
d 217.201.2.3
–
j DROP
M
ANAGEMENT AND CONFIGURATION COMMANDS
In order that the rules set by
iptables
are saved in the configuration and initiated at the next
reboot, there are two possibilities. The first one requires the following syntax for all the commands:
set iptables <options>
