Iptables rules, forward between two interfaces
- by Marco
i have a some difficulties in configuring my ubuntu server firewall ... 
my situation is this:
eth0 - internet
eth1 - lan1
eth2 - lan2
I want that clients from lan1 can't communicate with clients from lan2, except for some specific services. E.g. i want that clients in lan1 can ssh into client in lan2, but only that. Any other comunication is forbidden.
So, i add this rules to iptables:
#Block all traffic between lan, but permit traffic to internet
iptables -I FORWARD -i eth1 -o ! eth0 -j DROP
iptables -I FORWARD -i eth2 -o ! eth0 -j DROP
# Accept ssh traffic from lan1 to client 192.168.20.2 in lan2
iptables -A FORWARD -i eth1 -o eth2 -p tcp --dport 22 -d 192.168.20.2 -j ACCEPT
This didn't works. Doing iptables -L FORWARD -v i see:
    Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    33   144 DROP       all  --  eth1 !eth0   anywhere             anywhere
    0     0 DROP       all  --  eth2 !eth0   anywhere             anywhere
23630   20M ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth1   any     anywhere             anywhere
  175  9957 ACCEPT     all  --  eth1 any     anywhere             anywhere
  107  6420 ACCEPT     all  --  eth2 any     anywhere             anywhere
    0     0 ACCEPT     all  --  pptp+  any     anywhere             anywhere
    0     0 ACCEPT     all  --  tun+   any     anywhere             anywhere
    0     0 ACCEPT     tcp  --  eth1 eth2  anywhere             server2.lan tcp dpt:ssh
All packets are dropped, and the count of packets for the last rule is 0 ... 
How i have to modify my configuration? Thank you.
Regards
Marco