How to use iptables to deal with two Ethernet ports?

eth0 port for LAN use ( Private IP).

eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP).

ifconfig outout:

eth0      Link encap:Ethernet  HWaddr 00:19:99:C1:86:BB
          inet addr:  Bcast:  Mask:
          RX packets:137532 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55658 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:99968969 (95.3 MiB)  TX bytes:10403525 (9.9 MiB)
          Interrupt:50 Memory:fe700000-fe720000

eth1      Link encap:Ethernet  HWaddr 00:19:99:C1:61:3B
          inet addr:80.0.xxx.xxx  Bcast:  Mask:
          RX packets:144558 errors:0 dropped:0 overruns:0 frame:0
          TX packets:70347 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:34500131 (32.9 MiB)  TX bytes:27893843 (26.6 MiB)
          Interrupt:177 Memory:fe600000-fe620000

How to use iptables to block all the incoming route to eth1 but only allow port 22. So that on Internet side can't access to our web server, ftp server, etc. Only allow port 22 for SSH access. Ping should also work too.

On the local network (eth0), there are over 70 client PC's - They should be able to access anything on the server but just block internal local ip's and from accessing to (private ip) server.

How can it be done using iptables?

2 Answers 2


You can use -i device and -o device to match ethernet devices. E.g.,

iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCEPT # must allow machine to talk to itself, else much breakage.
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Or similar. You can also use -s/-d to filter on source and destination IP address.

I suggest naming your Ethernet interfaces, so that you could have -i lan & -i wan instead. You can name them in your udev rules. On Debian, you'd edit /etc/udev/rules.d/70-persistent-net.rules.

PS: When filtering your WAN interface, make sure DHCP still works, if you're using it. Else your connection will mysteriously break when the lease expires, which could be a while later.

  • Ah I see, thanks. Does iptables -P INPUT DROP refer to all ethernet devices? Which mean drop everything by default to all available ethernet devices? Feb 6, 2013 at 0:55
  • @I'll-Be-Back It sets what happens if no rule matches. I suggest at least skimming through the iptables manpage.
    – derobert
    Feb 6, 2013 at 2:55


You mentioned making port 21 open for ssh. Standard usage for port 21 is ftp; port 22 is the standard ssh. While possible (and sometimes desirable) to use a non-standard ssh port, if you forget (or forget to tell other users) you'll end up with a lot of headache.

That said, a collection of commonly used iptables examples can be found here.


More generalized IPTables reference:


  • Sorry, I meant port 22 for SSH. I edited my answer. I am aware of iptables tutorial and I am familiar using one Ethernet port filtering but my question is about filtering two Ethernet ports. Could you kindly give me example from my question, thanks. Feb 5, 2013 at 23:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .