Hi, do I need specially forward-Rules when I restrict the access with input and output-rules? I think it's not neccessary because when a packet matches a rule and it's allowed to pass the internet-interface I needn't filter it by forward-rules.

Has anyone other arguments?

Bye, Hannes

That's my understanding. I'd think that if you have a rule under input that you wouldn't need it under forward as well....I'm not 100% sure though, I'd like to know as well

you should have you default policy for forwarding set to DENY though.

Your iptables rules goes as follows:

INPUT = to anything that is addressed to the firewall itself.

OUTPUT= anything that is sent from the firewall itself.

FORWARD = anything transversing the firewall.

The FORWARD chain really comes into play in masqueraded networks. When you have clients hiding behind the linux box sharing its ipaddress.

In other words. When a packet arrives from the internet and is being addressed to one of the clients then it will go through the FORWARD chain. When a client sends a packet back out it will go through the FORWARD chain again.

INPUT and OUTPUT would be for packets coming in and going from the linux box itself.