First iptables script - comments please

First iptables script - comments please

[Craig H. Anderson]

I've just tried iptables for the first time
and would like comments on this simiple
script.

Gateway box with
   cable modem on one NIC (eth2)
   2 NIC's connected to local hubs.
   local subnets are 10.0.0.0/24 and 10.0..1.0/24
   only 10.0.0.0 is currently in use

I am successful in getting to the internet
with this script.

# $Id: localFirewall,v 1.1 2002/10/03 16:31:21 craig Exp $
iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -d 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -j DROP

Re: First iptables script - comments please

[Zoilo]

On Thursday 03 October 2002 19:22, Craig H. Anderson wrote:
> I've just tried iptables for the first time
> and would like comments on this simiple
> script.
>
> Gateway box with
>    cable modem on one NIC (eth2)
>    2 NIC's connected to local hubs.
>    local subnets are 10.0.0.0/24 and 10.0..1.0/24
>    only 10.0.0.0 is currently in use
>
> I am successful in getting to the internet
> with this script.
>
> # $Id: localFirewall,v 1.1 2002/10/03 16:31:21 craig Exp $
> iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
> iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT
> iptables -A FORWARD -d 10.0.0.0/24 -j ACCEPT
> iptables -A FORWARD -j DROP

I would say that it's somewhat minimalistic, but OK.

Better to use "iptables -P FORWARD DROP" to establish default DROP-policy for 
the FORWARD chain, although you effectively achieve the same result by 
putting your DROP-rule at the end of the list.

A little further improvement may be obtained by adding "-i eth0" and "-o 
eth0" to your FORWARD rules.

And don't forget to handle INPUT and OUTPUT chains as well (default DROP 
policy).

-- 
Z.
------------------------------------------------------------
"If all you have is a hammer, everything looks like a nail."