Iptables INPUT, OUTPUT and FORWARD chains

Question

I have a machine that has two interfaces, eth0 and eth1, eth0 facing the INTERNET and eth1 facing DMZ.

I understand OUTPUT and INPUT with regards to eth0 if defined as:

iptables -A INPUT  -i eth0 -j eth0_input
iptables -A OUTPUT -i eth0 -j eth0_output

But I am a little unsure about the forward chain if defined as

iptables -A FORWARD -i eth0 -j eth0_forward

I never came along the case where I had to think about eth1 with respect to eth0 and the forward chain BUT this morning as in 99.99% (it seems) of the cases it just routes the packets towards the machines that are behind eth1.

Is the eth1 interface part of eth0_input and eth0_output or is it part of eth0_forward?

thanks

Answer 1

I believe you are asking the wrong question. eth1 interface is not part of eth0_input, and eth0_output is not part of eth0_forward - although they may be related in your configuration

• eth0 and eth1 are interfaces.
• eth0_input, eth0_output and eth0_forward are constructs created by your configuration rules, and while descriptive are entirely arbitrary.

Rules are separate to interfaces, although they interact with them.

In general -

• Packets destined to the local machine are handled by the INPUT chain. Relatedly, Packets originating from the local machine (ignoring NAT) are handled with the OUTPUT chain.

• Packets from other machines behind the router go through the FORWARD chain.

You will most likely find that eth0_forward chain has been used to control what servers & ports are exposed to the Internet, ie traffic originating from eth0 will be traffic from the world, and should only be allowed if - It corresponds to an outbound stream (ie caught by an earlier ESTABLISHED,RELATED rule) or is to a known port on a known system - in which case it should be allowed or rejected before it reaches eth1. THE RULE AS WRITTEN DEALS WITH TRAFFIC FROM THE WORLD BEFORE IT GETS TO THE LAN SIDE OF THE FIREWALL.