title: iptables FORWARD and INPUT
body: <p>I have a home network with Linux pc's, which all had iptables running. I think it is easier to put my LAN behind a Linux gateway/firewall, so I've put a pc (with fedora,no gui) between my router and LAN and configured iptables. No problem here, INPUT only allows dns an http (and some local stuff), forwarding works fine: LAN connects to internet.</p>
  
  <p>But my question is: does FORWARD allows all from the outside, or only the ports I configured with INPUT? Do FORWARD and INPUT work together or are they separate?</p>
  
  <p>This is my iptables:</p>
  
  <pre><code>*nat
  :PREROUTING ACCEPT [16:1336]
  :INPUT ACCEPT [14:840]
  :OUTPUT ACCEPT [30:2116]
  :POSTROUTING ACCEPT [0:0]
  -A POSTROUTING -o p1p1 -j MASQUERADE
  COMMIT
  # Completed on Tue Oct 16 09:55:31 2012
  # Generated by iptables-save v1.4.14 on Tue Oct 16 09:55:31 2012
  *filter
  :INPUT DROP [0:0]
  :FORWARD DROP [0:0]
  :OUTPUT ACCEPT [91:9888]
  -A INPUT -i lo -j ACCEPT
  -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  -A INPUT -p UDP --dport 53 -j ACCEPT
  -A INPUT -p TCP --dport 53 -j ACCEPT
  -A INPUT -s 192.168.1.0/24 -i p1p1 -p tcp -m multiport --dports 20,21 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A INPUT -s 192.168.2.0/24 -i p3p1 -p tcp -m multiport --dports 20,21 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A INPUT -s 192.168.1.0/24 -i p1p1 -p tcp -m tcp --dport 5000:5100 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A INPUT -s 192.168.2.0/24 -i p3p1 -p tcp -m tcp --dport 5000:5100 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A INPUT -i p1p1 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A INPUT -s 192.168.2.0/24 -i p3p1 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A INPUT -s 192.168.1.0/24 -i p1p1 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A INPUT -i p1p1 -p tcp -m multiport --dports 20,21,443 -j DROP
  -A INPUT -i p1p1 -p tcp --dport 5000:5100 -j DROP
  -A INPUT -i p1p1 -p icmp -m icmp --icmp-type 8 -j DROP
  -A FORWARD -s 192.168.2.0/24 -j ACCEPT
  -A FORWARD -d 192.168.2.0/24 -j ACCEPT
  -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
  -A OUTPUT -j LOG --log-prefix "denied out: "
  
  COMMIT
  </code></pre>
  
  <p>p1p1 (.1.x) is my external nic, p3p1 (.2.x) is internal.</p>