1

I have three virtual machines: A, B and C, all of them are running on debian. I have set up C to route traffic between A and B. Also C has two interfaces: enp0s3 and enp0s8, not sure if it's important in this case. The routing works fine.

But now I want to set up iptables on the router to block all incoming requests except the ones that are sent to 8080 port.

Here is what I do:

iptables -P FORWARD DROP
iptables -A FORWARD -p tcp --dport 8080 -j ACCEPT

But then if I try to connect to any port (including 8080) on B from A using nc {host} {port}, my input is not being translated from A to B.

I also tried it vice-versa:

iptables -P FORWARD ACCEPT
iptables -A FORWARD -p tcp ! --dport 8080 -j DROP

but it doesn't work either.

When I check the output of iptables -L -v there are some packets being accepted in FORWARD chain.

  • 1
    You're blocking both directions. So the ephemeral initiating port (which is certainly not 8080) is blocked in the reverse direction. You need stateful rules. See for example: wiki.archlinux.org/index.php/… . The important part is the rule which includes -m conntrack. Adapt it for FORWARD instead of INPUT. – A.B Mar 4 '18 at 17:59
0

iptables -A FORWARD -p tcp --dport 8080 -j ACCEPT
This rule will allow forwarding of all packets going to port 8080 However packets from port 8080 (Responses to the SYN Packet) are not forwarded unless the port making the request is also port 8080. As mentioned in one comment this is most likely not the case!

You would need a second rule:

iptables -A FORWARD -p tcp --sport 8080 -j ACCEPT

this rule allows all packets comming from port 8080 to be allowed in forwarding

as a recommendation i would add the ip adresses of the machines to the rules if you need more security in your setup, as with these 2 rules someone could talk to a different port as long as his source port is 8080.

so my final rules would be:

iptables -A FORWARD -p tcp --sport 8080 -s IPOFMACHINEA -j ACCEPT
iptables -A FORWARD -p tcp --dport 8080 -d IPOFMACHINEA -j ACCEPT

iptables -A FORWARD -p tcp --sport 8080 -s IPOFMACHINEB -j ACCEPT
iptables -A FORWARD -p tcp --dport 8080 -d IPOFMACHINEB -j ACCEPT

Since you didnt provide ips you will have to substitute them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.