IP Networking

edit: SOLVED - see below for solution

Hi there,

I've inherited a gob of Linux hosts and so am learning linux from the bottom of the deep end of the pool (gotta say I'm warming up to Linux though - it's not half bad)

Right now iptables is confusing me and I could use some pointers as to how I can take a host using MASQEURADE rules between two NICs and have it only allow outbound connections, blocking inbound ones.

Current state:
iptables running on a reverse proxy host with two nics, one nic on a public IP in the DMZ, one on a private IP on a private LAN.
This box takes web requests from the DMZ and fires them at a cluster of webservers on the private net.

My predecessor has figured out that adding an iptables rule:

Code:

-A POSTROUTING -o eth1 -j MASQUERADE

Will allow hosts on the private net to get to the internet (rather handy)

The problem is, this also allows someone that owns any DMZ host to set up a route on it and connect directly to any port on any host on the private net *from the DMZ*

The Question:
How do I have the proxy host (the one with the MASQ rule) only do this from eth0 and going out eth1?

iptables --list:

Code:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

(ie blank)

iptables -t nat --list:

Code:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

(ie just the MASQ rule)


---------- Post updated at 09:24 AM ---------- Previous update was at 08:52 AM ----------
The Solution

Ah, I figured it out - but would still appreciate peer review if anyone has feedback on this.

Writing the question down must have helped my brain straighten the problem out as the solution popped into my head suddenly.

I need a FORWARD rule in the FILTER table because I'm trying to filter a forwarded packet.

I added these rules to the filter table and changed it's default policy to DROP:

Code:

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1       45 11573 ACCEPT     all  --  any    eth0    anywhere             anywhere            state RELATED,ESTABLISHED 
2      414 36553 ACCEPT     all  --  eth0   any     anywhere             anywhere

I guess I could have had a DROP or REJECT rule that looked for a state of NEW on eth1 but I slightly prefer the paranoid approach of "drop it if I can't think of a reason not accept it" vs "accept it if I can't think of a reason to drop it"

So far, all seems to work.