I have multiple ethX interfaces.
eth0is connected to the internet.
eth1is connected to a trusted network.
eth2is connected to a network I need to impose usage rules.
What I'd like to do is separate
eth2 into their own chains (trusted/untrusted) simply to maintain "easy on the eyes" rules.
:INPUT DROP -A INPUT ! -i eth0 -j ACCEPT # allows INPUT on traffic not internet based ... # More rules for eth0 allowing PING and shunting most everything else -A INPUT -i eth1 -j trusted -A INPUT -i eth2 -j untrusted
OUTPUT and FORWARD are currently set to ACCEPT due to the problems.
For the time being,
eth1 is just jumping to chain masquerade which is perfectly fine for the moment, but the confusion lies as to how to manipulate
eth2 as it hasn't panned out too well with my attempts.
My guess was to list all of the ALLOWED ports/protocols, but so far it's not working as devices connected through
eth2 cannot reach anything, not even the firewall server's DNS/DHCP.
:untrusted -A untrusted -i eth2 -p tcp -m tcp --dport 80 -j ACCEPT
What I need is basically a set of rules which "say" the following:
- If outgoing internet traffic on
eth0is not PING, DROP
eth1goes out to internet (
eth0), accept it
eth2goes out to internet on TCP port 80, accept it, drop everything else.
- To GO out to internet, use masquerade through
Any thoughts/suggestions would be truly appreciated!