iptables blocking from internet side on eth1?

Question

How to use iptables to deal with two Ethernet ports?

eth0 port for LAN use (192.168.1.50 Private IP).

eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP).

ifconfig outout:

eth0      Link encap:Ethernet  HWaddr 00:19:99:C1:86:BB
          inet addr:192.168.1.50  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:137532 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55658 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:99968969 (95.3 MiB)  TX bytes:10403525 (9.9 MiB)
          Interrupt:50 Memory:fe700000-fe720000

eth1      Link encap:Ethernet  HWaddr 00:19:99:C1:61:3B
          inet addr:80.0.xxx.xxx  Bcast:255.255.255.255  Mask:255.255.252.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:144558 errors:0 dropped:0 overruns:0 frame:0
          TX packets:70347 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:34500131 (32.9 MiB)  TX bytes:27893843 (26.6 MiB)
          Interrupt:177 Memory:fe600000-fe620000

How to use iptables to block all the incoming route to eth1 but only allow port 22. So that on Internet side can't access to our web server, ftp server, etc. Only allow port 22 for SSH access. Ping should also work too.

On the local network (eth0), there are over 70 client PC's - They should be able to access anything on the server but just block internal local ip's 192.168.1.20 and 192.168.1.30 from accessing to 192.168.1.50 (private ip) server.

How can it be done using iptables?

Solution

You can use -i device and -o device to match ethernet devices. E.g.,

iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCEPT # must allow machine to talk to itself, else much breakage.
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Or similar. You can also use -s/-d to filter on source and destination IP address.

I suggest naming your Ethernet interfaces, so that you could have -i lan & -i wan instead. You can name them in your udev rules. On Debian, you'd edit /etc/udev/rules.d/70-persistent-net.rules.

PS: When filtering your WAN interface, make sure DHCP still works, if you're using it. Else your connection will mysteriously break when the lease expires, which could be a while later.

Comments

[I'll-Be-Back]

Sorry, I meant port 22 for SSH. I edited my answer. I am aware of iptables tutorial and I am familiar using one Ethernet port filtering but my question is about filtering two Ethernet ports. Could you kindly give me example from my question, thanks.

[I'll-Be-Back]

Ah I see, thanks. Does iptables -P INPUT DROP refer to all ethernet devices? Which mean drop everything by default to all available ethernet devices?

[derobert]

@I'll-Be-Back It sets what happens if no rule matches. I suggest at least skimming through the iptables manpage.