I struggling with just dropping incoming traffic on a simple Ubuntu machine that acts as NAT router.

What I did so far:

I activated net.ipv4.ip_forward=1 in /etc/sysctl.conf

To have NAT i activated following in iptables

sudo iptables ! -o lo -t nat -A POSTROUTING -s -j MASQUERADE

Fine everything works as expected.

Now I want to drop incoming traffic on the WAN interface. Therefore I did following:

# SSH still allowed
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT )

And then:

sudo iptables -A INPUT -i eth0 -j DROP

Unfortunately the last command blocks, all http traffic on the machine itself. No outgoing traffic is allowed anymore. From the NAT machines it still works.

So the rule sudo iptables -A INPUT -i eth0 -j DROP seems to be the wrong if I just want to block traffic from the Internet.

1 Answer 1


Remember that a (tcp) connection transfers data in both directions: a command as simple as curl google.com involves:

  • Query a DNS server
  • Receive a reply from a DNS server
  • Send an HTTP request to a remote website
  • Receive the HTTP response from a remote website

If you block all incoming traffic with -A INPUT -i eth0 -j DROP, you will be blocking the "Receive..." portion of all of those transactions. You need to minimally permit traffic that is associated with an ESTABLISHED connection. For what you're doing, a simple firewall might look like:

# Allow RELATED and ESTABLISHED traffic

# Allow ICMP traffic
-A INPUT -p icmp -j ACCEPT

# Allow all traffic on lo. This isn't strictly necessary for what you're
# doing, but it helps avoid shooting yourself in the foot later
# on.
-A INPUT -i lo -j ACCEPT

# Allow new ssh connections
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

# Reject anything else coming in on eth0. You could use
# DROP here if you prefer.
-A INPUT -i eth0 -j REJECT --reject-with icmp-host-prohibited

(This is the based on the default set of firewall rules created by the iptables-services package on Fedora.)

  • Great, thank you so much!!! I just couldn't find it explained that well anywhere. In particular, I should avoid using the host as a router from the Internet. But that should be given with the last rule. Perfect thank you Could anyone note this as answer? I haven't got enough reputation so far, as I reconnected my account. Thank you.
    – Airwave
    Commented Jan 7, 2023 at 10:47
  • Only you can accept this answer, because you’re the one who asked the question. There’s no reputation requirement for being able to accept an answer.
    – larsks
    Commented Jan 7, 2023 at 13:35
  • Ah thank you. I got it :-)
    – Airwave
    Commented Jan 8, 2023 at 18:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .