On 8/9/05, Alexander Salmin <security.member@xxxxxxxxx> wrote: > #1 --- 192.168.51.20 --- Should be able to access all internet. > #2 --- 192.168.51.40 --- Should be able to access only websites (port 80,443). > #3 --- 192.168.51.80 --- Should be able to access only websites (port 80,443). Consider your reasons for restricting #2 and #3. It is trivially easy to get around port restrictions only (just run a ssh server on port 80 for example). > This is how my non-working iptables-script looks like right now: > ------------------------------------------------------------------------------------- > INT="eth0" > EXT="eth1" > IPTABLES=/sbin/iptables > > $IPTABLES -F INPUT > $IPTABLES -F OUTPUT > $IPTABLES -F FORWARD > $IPTABLES -F -t nat > > $IPTABLES -P INPUT DROP > $IPTABLES -P OUTPUT DROP > $IPTABLES -P FORWARD DROP > > $IPTABLES -A INPUT -i $INT -m state --state ESTABLISHED,RELATED -j ACCEPT > $IPTABLES -A INPUT -i eth0 -p icmp -j ACCEPT > $IPTABLES -A INPUT -p UDP --dport bootps -i $INT -j ACCEPT > $IPTABLES -A INPUT -p UDP --dport domain -i $INT -j ACCEPT Since you have no OUTPUT rules and OUTPUT drops by default, these INPUT rules don't do anything useful. You probably want to allow ESTABLISHED,RELATED traffic in OUTPUT as well, for example. > $IPTABLES -t nat -A POSTROUTING -s 192.168.51.20 -o $EXT -j MASQUERADE > $IPTABLES -t nat -A POSTROUTING -s 192.168.51.40 -dport 80 -o $EXT -j MASQUERADE > $IPTABLES -t nat -A POSTROUTING -s 192.168.51.80 -dport 80 -o $EXT -j MASQUERADE > > $IPTABLES -A INPUT -j DROP > ------------------------------------------------------------------------------------- Definitely add the FORWARD rules spooker talked about. And consider some more intelligent/"deep" traffic inspection if you want to restrict some of your hosts.
