I am trying to setup a Transparent Firewall using ArchLinux.

My setup looks like this:

  \ (eth0-> ip: gateway:
   |           |
   |    PC     |
   |(as server)|
                \ (eth1-> ip:
     (\        | (wireless-> ip-range:
                    |Router |

My router does not have firewalling capacities, therefore I need to drop a firewall between the router and my ISP.

migrated from serverfault.com May 29 '13 at 15:54

This question came from our site for system and network administrators.

  • Network masks? Do you want eth0 and eth1 on "PC" bridged? – mulaz May 29 '13 at 15:22
  • 2
    Unusual to have the "server" on the ISP connection and the "router" behind the server... – Hauke Laging May 29 '13 at 15:26
  • @HaukeLaging yes, it's unusual, but i need apply some firewall rules and traffic control, and the router doesn't have this functionalities – Victor Aurélio May 29 '13 at 15:33
  • When you say "router", do you really mean "wireless access point"? It sure looks like it... – derobert May 29 '13 at 16:59
  • @derobert yes, I mean a really router, a Dlink... I configured the network with answer of Cha0s and now is working as expected! – Victor Aurélio May 29 '13 at 18:07

To accomplish that, you need to put eth0 and eth1 into bridge mode on the PC and give 1 ip to the bridge interface (not on the individual eths)

Here are the basics about bridging on linux, to get started http://www.tldp.org/HOWTO/BRIDGE-STP-HOWTO/index.html

Depending on your distro there might be a faster/better way to do bridging.

Now, the wireless IP range you mentioned, cannot be specified via some configuration. It is up to you which IPs you will allocate where.

Maybe you could control that via DHCP, but it depends on your overall setup and needs.

  • Ok, I'll read... I use ArchLinux, then after I'll do some search in ArchWiki. Thanks for you answer! – Victor Aurélio May 29 '13 at 15:34
  • I setup the bridge using netctl (Archlinux default's), After this I setup the router (D-Link DI-524) in bridge mode also, then now my network is working as well, thank you again! – Victor Aurélio May 29 '13 at 18:04
  • 1
    Note that with a bridged setup, your normal iptables firewall rules will not apply. You may have some luck with ebtables if you want to do firewalling, but I'd recommend a routed setup instead. – Jander May 30 '13 at 4:35

First you should enable network address translating:
Insert this line

net.ipv4.ip_forward = 1



(after line inserted, effect take immediately) and adding firewall rule:

iptables -t NAT -A POSTROUTING -!o lo -j MASQUERADE

And now the wireless network can send packets trougth server PC to ISP
One more suggestion: disable "all" access to server and enable only what you really need:

iptables -P INPUT DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -m state --state NEW -j ACCPET

this settings disables the default "all permitted" packet flow, it's disabled to connect from ISP (and WAN) to server ports, enables outgoung connections from wireless network.
If you need to open server ports in firewall:

iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

replace tcp to udp if that needed, and port ranges can add with from:to pattern.
if something wrong and close out yourself, you can reset firewall rules:

iptables -F

The easyest way, if you install a webmin into your server system, it's have great firewall configurator GUI. But always remember the "iptables -F" command if you close out yourself, and can not access webmin

  • I've tried this but it isn't working, eth0:; eth1:; router:; % sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1 % sudo iptables -t nat -L -n [...] Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- PS: I did changed your iptables rule for # iptables -t nat -A POSTROUTING ! -o lo -j MASQUERADE – Victor Aurélio May 31 '13 at 12:46

That should be possible (from the server's perspective) if you define eth0 (and perhaps eth1, too) as a point-to-point interface (see man ip-address, peer).

From my opinion the address selection is a bad idea in every aspect. The networks of eth1 and the WLAN should not overlap. That is not possible if eth1 is not a point-to-point interface and the WLAN starts at 102.

Even worse on the router: Its LAN IP is part of the WLAN network so it would have to be p2p, too (can that be configured on the router?).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.