This is an old revision of the document!
Iptables/Netfilter classical sample
Netfilter rules example
#!/bin/sh # Interfaces EXTIF1=eth0 EXTIF2=usb0 INTIF1=vboxnet0 INTIF2=wlan0 # Delete all existing rules iptables -F iptables -X iptables -t nat -F iptables -t mangle -F # Always accept loopback traffic iptables -A INPUT -i lo -j ACCEPT # Allow established connections, and those not coming from the outside iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m conntrack --ctstate NEW -i $INTIF1 -j ACCEPT iptables -A INPUT -m conntrack --ctstate NEW -i $INTIF2 -j ACCEPT # Allow outgoing connections from the LAN side iptables -A FORWARD -i $INTIF1 -j ACCEPT iptables -A FORWARD -i $INTIF2 -j ACCEPT # Connect LANs iptables -A FORWARD -i $INTIF -o $INTIF2 -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $INTIF -j ACCEPT iptables -A FORWARD -i $INTIF -o $INTIF -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $INTIF2 -j ACCEPT # Masquerade iptables -t nat -A POSTROUTING -o $EXTIF1 -j MASQUERADE iptables -t nat -A POSTROUTING -o $EXTIF2 -j MASQUERADE # Don't forward from the outside to the inside iptables -A FORWARD -i $EXTIF1 -j REJECT iptables -A FORWARD -i $EXTIF2 -j REJECT # MTU iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu # Allow IP forward echo 1 > /proc/sys/net/ipv4/ip_forward # Switch On rp_filter for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done