All traffic to your "server" goes though FORWARD chain on "firewall".
Right now they are:
-A FORWARD -i eth0 -o eth2 -j ACCEPT # to the "server"
-A FORWARD -i eth2 -o eth0 -j ACCEPT # from the "server"

To add new filter on "firewall" you can add additional chain, for example:
-A forward_in_filter : for incoming filtration
-A forward_out_filter : for outgoing filtration
And modify them:

-A forward_in_filter -s <nasty IP> -j DROP #this will drop all from <nasty IP>
-A forward_in_filter -s <nasty IP> -j DROP
. . .
-A forward_in_filter -j ACCEPT #this will allow the rest.

And for outgoing:
-A forward_out_filter -m state --state NEW -j DROP #this will prevent connection start.
-A forward_out_filter -j ACCEPT #everything else goes out.

Now modify main chain:
-A FORWARD -i eth0 -o eth2 -j forward_in_filter
-A FORWARD -i eth2 -o eth0 -j forward_out_filter

1 members found this post helpful.

OK, I should learn more very much about iptables...

Do you means that could have one chains to filter "server" and another chains filter "firewal" and rest of traffic that not goes to "server"??
And ALL them DROP ??

They are all for "firewall"

Do not change anything in "server" - its job = web server.
"firewall" will do the rest.

1 members found this post helpful.

Mean leave all the original script (the script that I pasted on page 1 of this post) like is without changes, EXCEPT on the chain forward???

But then YES make the changes that you has proposed on chain FILTER FORWARD???
Of mode applied on same "firewall" (and with a more refined filter) one chain to filter traffic to/from "server" and other chain to filter traffic of rest of WAN / LAN ???

Leave script on "server" without changes.

If you decide to filter traffic do changes on "firewall" script.

1 members found this post helpful.

No, I wanna say:
Mean leave all the original script into machine "firewall" (the first script that I pasted on page 1 of this post) like it is, without changes, except on the chain forward???

Then make the changes that you has proposed on chain FILTER FORWARD???

So, to applied on the same "firewall" (and with a more refined filter) one chain to filter traffic to/from "server" and other chain to filter traffic of rest of WAN / LAN ???

Leave script, which you have sent to this forum "iptables_on_firewall.txt", your post:
http://www.linuxquestions.org/questi...08#post3805608

When you will decide, yes, change chains FORWAND on "firewall" computer, in accordance with my suggestions.

Traffic, which goes from one NIC to other - transit traffic, you can filter it out only in FORWARD chains.