At 3:16 PM +1030 3/14/07, Tim wrote:
>On Tue, 2007-03-13 at 22:28 -0400, Tony Nelson wrote:
>> I'm reading Rusty Russell's Linux iptables HOWTO now. Section 5 says
>> it works on IPs, not on interfaces.
>
>You can make rules that refer to interfaces. They're useful when you
>want to simply trust/distrust anything on it, or the addresses for it
>are changeable.
>
>A rule for any incoming ethernet interface:
>iptables --append INPUT --jump DROP --protocol tcp --in-interface eth+
>
>A rule for any incoming eth1 interface:
> iptables --append INPUT --jump DROP --protocol tcp--in-interface eth1
Note that these rules affect only packets addressed to an IP of this box,
and won't affect packets to other IPs, which will use the FORWARD chain,
according to Rusty's iptables HOWTO and my experiments. Traffic from my
box's IP to the VM's IP goes through the OUTPUT chain (which by default has
no rules), and traffic the other way goes through the INPUT chain. IIUC,
traffic from the world to the VM's IP should go through the FORWARD chain
either way, and doesn't use the INPUT or OUTPUT chains, and the counter I
put on FORWARD seems to agree.
/sbin/iptables -F FORWARD
/sbin/iptables -A FORWARD -j ACCEPT
--
____________________________________________________________________
TonyN.:' <mailto:tonynelson@xxxxxxxxxxxxxxxxx>
' <http://www.georgeanelson.com/>
