iptables forwarding to local interfaces

Question

I have the following setup:

MY-PC: eth1: 192.168.1.1 - - - 192.168.1.2 :eth0 :SERVER: eth1: 192.168.2.2

My SERVER can be used as a router and is not restricted by iptables. (No restrictions in the forwarding table.)

eth0 on the SERVER is only accessible on TCP port 80.

iptables -A INPUT -p tcp --dport 80 -i eth0 -j ACCEPT

eth1 on the SERVER is only accessible on TCP port 22.

iptables -A INPUT -p tcp --dport 22 -i eth1 -j ACCEPT

If I now try to access 192.168.2.2 (eth1) on port 22 from MY-PC, I can't connect.

A similar question is answered with answer 4 of this post, but the scenario happens on the local machine only.

Is it possible to access 192.168.2.2 (eth1) on port 22 on the SERVER even if 192.168.1.2 (eth0) only allows traffic on port 80?

Answer 1

The traffic from MY-PC to 192.168.2.2 isn't coming in eth1 on SERVER, it's coming in eth0. Thus the --dport 22 -i eth1 statement will not match the traffic.

I don't know what your end goal is, but given that you clearly intended to allow port 22 traffic on eth1, and you appear to also want it on eth0, just remove the -i eth1 clause from the rule.