iptables - Allow traffic from GRE tunnel with reject-with option

Question

System: CentOS 7.

/etc/sysconfig/iptables is like this:

...
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i gre1 -j ACCEPT # not working
-A OUTPUT -o gre1 -j ACCEPT # not working
-A INPUT -j REJECT --reject-with icmp-host-prohibited

If the last line exists, my GRE tunnel is not working, ping/everything does not work (although tcpdump captures ping packages at the other end) and if I remove the final line in the iptables file, everything works.

What "command" should I specify to allow all traffic from gre1 but iptables is still enforcing rules on eth0?

Thanks.

Answer 1

Ah.. A little test confirms this solution.

-A INPUT -p gre -j ACCEPT

using this will allow all gre packets.