Blocking FORWARD on iptables except port 80

I got a subnet that is protected by a computer that acts as a firewall. The rules I want this firewall to have are:

Deny all INPUT

iptables -A INPUT -j DROP

Allow all OUTPUT

iptables -A OUTPUT -j ACCEPT

Route all packets FROM the subnet to the outside

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Drop all packets from the outside to the subnet ???

Route packets to port 80 to a server in the subnet

iptables -t nat -A PREROUTING -d 192.168.2.143 -p tcp --dport 80 -j DNAT --to 172.16.32.131

The firewall's IP on eth0 is 192.168.2.143 and on eth1 is 172.16.32.254 and the server is 172.16.32.131

The subnet is 172.16.32.0/24

I got everything working except that it routes all packets from the outside to the subnet and not only those to the web server. How do I prevent this?

1 Answer

The default policy is to accept packets that do not match any rule. To change this, use:

iptables -P FORWARD DROP

You can check the current rule set with iptables -L. See also (the policy feature is mentioned on the bottom).