[CentOS] Using a CentOS 6 Machine as a gateway/router/home server

[Gordon Messmer]

On 06/28/2015 03:49 PM, Max Pyziur wrote:
> From several sources, code, the stock CentOS iptables I've cobbled the 
> following /etc/sysconfig/iptables; while it works, I suspect that 
> there are holes:
> # Firewall configuration written by system-config-firewall
> # Manual customization of this file is not recommended.
> *nat
> :PREROUTING ACCEPT [0:0]
> :POSTROUTING ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> -A POSTROUTING  -j MASQUERADE
> COMMIT
> *filter
> :INPUT DROP [0:0]
> :FORWARD ACCEPT [0:0] 

Some holes, yes.  I'd recommend that your FORWARD table be similar to 
INPUT.  It should DROP by default, and ACCEPT on traffic coming in the 
LAN interface and going out the WAN interface (and ESTABLISHED data).  
As it is now, a host on your WAN interface could use your system as its 
gateway, and you'd MASQ its traffic.

Possibly:

:FORWARD DROP [0:0]
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m state --state NEW -i eth0 -o eth1 -j ACCEPT

Best practice is to apply both egress and ingress filters as well. You 
should only forward traffic to the WAN if the source address is one that 
you use on your LAN.  You should only forward traffic to your LAN if the 
source is *not* an address you use in your LAN.

I think that looks like this in iptables, but I might be wrong...

:FORWARD DROP [0:0]
-A FORWARD -m state --state ESTABLISHED,RELATED -i eth1 -s ! 
192.168.1.0/24 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -i eth0 -j ACCEPT
-A FORWARD -m state --state NEW -i eth0 -o eth1 -s 192.168.1.0/24 -j ACCEPT