Linux firewall configuration-Allow forwarding

first, the experimental target

In the last "Linux Foundation Network Building Experiment", the internal and external network virtual machine can ping, because temporarily shut down the firewall, but in reality this operation obviously has a great security risk, so this experiment on the basis of the last experiment, open the firewall, and configure firewall rules, so that the internal and The outside network virtual machine still can ping pass.

(Linux Basic Network Setup experiment: http://www.cnblogs.com/liaoyuanyang/p/6749416.html)

Network topology diagram:

second, the experimental steps

1. Build Network (refer to "Linux Basic Network Building Experiment")

2, open the firewall on the gateway, at this time the intranet virtual machine can not ping the external network virtual machine

[[Email protected] Desktop]# service iptables start

3. Clear Firewall (Filter) all rules

In general, when you re-establish the firewall rules, you should first clear the original rules, and then one to set

[[Email protected] Desktop]# iptables--X//Kill many users of "custom" chain (or tables)
-Z//to zero all chain counts and flow statistics

4. Define default rules

[[email protected]desktop]# iptables----a forward-i eth0-p ICMP--a forward-i eth1-p Icmp-j ACCEPT
[[Email protected] Desktop]# iptables-save//list full firewall rules

Rule explanation:
iptables-a forward-i eth0-p ICMP-  J ACCEPT
Added a forwarding rule that allows ping packets coming in from eth0 to pass through
-a:add, which indicates a new rule, positioned at the end of the original rule
-i:input, from which interface to enter, need to match with the input chain
-P: Sets which packet format this rule applies to (for example: TCP, UDP, ICMP, and All)
Icmp:ping Bag
-j: After the action, the main actions are: Accept, discard (drop), Reject (REJECT) and record (log)

Third, test results

Ping An Extranet virtual machine on an intranet virtual machine

Linux firewall configuration-Allow forwarding