Problem with iptables -A FORWARD -j DROP

Problem with iptables -A FORWARD -j DROP

[Gabriel Güeto]

[-- Attachment #1: Type: text/plain, Size: 570 bytes --]

Hello, I'm installing a bridge-firewall an all is OK, but whe I deny all the 'FORWARD' traffic this rule deny all the traffic included the 'ACCEPT' rules. Mi Kernel is 2.4.18
and i installed itables 1.2.5-3. My script is:

iptables -F FORWARD
iptables -F INPUT
iptables -F OUTPUT

iptables -A FORWARD -p icmp -s 89.0.0.0/24 -d 89.0.0.55/32 -j ACCEPT

iptables -A FORWARD -j DROP



If I quit the las line it's all OK, if I deny 'ping' it's OK, but if I put the last line all ping are deny.

Can somebody help me. I'm sorry for mu poor English.

Gabriel.

[-- Attachment #2: Type: text/html, Size: 1688 bytes --]

Re: Problem with iptables -A FORWARD -j DROP

[Bernd Podey]

Gabriel Güeto wrote:
> Hello, I'm installing a bridge-firewall an all is OK, but whe I deny all 
> the 'FORWARD' traffic this rule deny all the traffic included the 
> 'ACCEPT' rules. Mi Kernel is 2.4.18
> and i installed itables 1.2.5-3. My script is:
>  
> iptables -F FORWARD
> iptables -F INPUT
> iptables -F OUTPUT
>  
> iptables -A FORWARD -p icmp -s 89.0.0.0/24 -d 89.0.0.55/32 -j ACCEPT
>  
> iptables -A FORWARD -j DROP
>  
>  
>  
> If I quit the las line it's all OK, if I deny 'ping' it's OK, but if I 
> put the last line all ping are deny.
>  
> Can somebody help me. I'm sorry for mu poor English.
>  
> Gabriel.
Hello!

You have to allow both communication directions!

Try the following:
iptables -A FORWARD -p icmp -s 89.0.0.0/24 -d 89.0.0.55/32 -j ACCEPT
iptables -A FORWARD -p icmp -s 89.0.0.55/32 -d 89.0.0.0/24 -j ACCEPT

iptables -A FORWARD -j DROP

and everything will work fine

Bernd

RE: Problem with iptables -A FORWARD -j DROP

[Rob Sterenborg]

> [mailto:netfilter-admin@lists.netfilter.org] Namens Gabriel Güeto

> iptables -A FORWARD -j DROP

And when you use : "iptables -P FORWARD DROP" instead ? (It should do
the same thing..)


Rob