1
iptables -A FORWARD -s 192.168.20.7 -d 10.10.48.3 -p tcp --dport 25 -o eth1 -j ACCEPT
iptables -A FORWARD -s 10.10.48.3 -d 192.168.20.7 -p tcp --sport 25 -i eth1 -j ACCEPT

Tuning the firewall of my organization I found these two lines which confused me. The eth1 interface is connected to the 10.10.x.x network, so... does it make sense to put the -o eth1 and the -i eth1 if that is already implied by the -d 10.10.48.3 and -s 10.10.48.3, respectively?

  • 1
    If your eth1 goes down, you don't want those packets to go via the default route. It's better to be as restrictive as possible for ACCEPT rules. Here you only want those packets emitted on that interface. – Stéphane Chazelas Sep 16 '14 at 12:55
  • @StéphaneChazelas but the point, as I just added on slm's answer, is that is impossible that the packets go by the other interface, as it's intended for the 192.168.x.x network – yzT Sep 16 '14 at 12:59
1

Based on the man page for iptables I'd be inclined to agree with your assessment as well.

   [!] -i, --in-interface name
        Name of an interface via which a packet was received (only for 
        packets entering the INPUT, FORWARD and PREROUTING chains).  When 
        the "!" argument is used before the interface name, the sense is 
        inverted.  If the interface name ends in  a  "+",  then  any  
        interface which begins with this name will match.  If this option
        is omitted, any interface name will match.

   [!] -o, --out-interface name
        Name of an interface via which a packet is going to be sent (for 
        packets entering the FORWARD, OUTPUT and POSTROUTING chains).  When
        the "!" argument is used before the interface name, the sense is 
        inverted.  If the interface name ends in a "+", then any  interface
        which begins with this name will match.  If this option is omitted, 
        any interface name will match.

The last sentence in those descriptions is really the only point of concern. If there are other interfaces on the box traffic could be allowed by this rule to make use it, with the -o or -i options omitted. This is all assuming that the routing and such is setup to allow for that to even happen.

  • there is another interface, eth0, which is use by the 192.168.x.x network. The point is that, in my opinion (I might be wrong, that's why I'm asking), both are redundant conditions as it would be impossible to match -d 10.10.48.3 and -o eth0 for example. – yzT Sep 16 '14 at 12:55
  • @yzT - assuming that nothing changes on the box, I'd agree with you. If someone were to swap the cables on the NICs with the -o and -i rules in place, the box would cease to work. Without them, then it would likely continue to work. Also if the hardware fails and you do not have the -i or -o in place packets could egress out via the other i/f. – slm Sep 16 '14 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.