iptables rule for local network with free internet blocking unrequested connection from internet to server?

Question

I have a home server (with slackware 13) with a eth0 for the local network and a eth1 for the internet (cable modem with dynamic ip).

While I do want to learn more about iptables I am still on the proccess and I need some rules done and can't until a learn to do it as I dont wish my server to get compromised at this stage.

I currently have a vm where I play with my rules and everything and would appreciate if some one could wrap me a firewall rule for iptables to do the below:

1. Allow all users from my dhcp server on eth0 to have full access to internet and server, in other words eth0 should have no restrictions within the network and server.
2. Allow all users to be able to create a server, for example if they are playing a game such as for example warcraft, and they create a game, the firewall should allow the negotiation of those connections to go thru.
3. Block any requests from internet to server unless it was initiated by the server or an users from the network.

Answer 1

So, basically your Linux box acts as a firewall?

First, enable IP forwarding.

echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

Then, add some forwarding rules:

iptables -A FORWARD -i eth0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Secure the FORWARD chain:

iptables -P FORWARD DROP

Create a NAT rule:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Finally, don't forget to check that you have a default route:

ip route show | grep default

You should see something like:

default via <IP_of_eth1's_gateway> dev eth1

If not, add one:

ip route add default vie <IP_of_eth1's_gateway> dev eth1

(Usually the DHCP client will automatically add one)

Answer 2

For allowing servers, you can manually add port-forward rules, or use a uPnP daemon (if the applications support uPnP - many do...) [linux-igd][1] should do that...

NAT-PMP is similar and used by some other applications. An implementation for Linux is here.