[arch-general] iptables forward policy

[Damjan]

On 25.08.2012 18:47, Juan Diego Tascón wrote:
> Good day,
>
> I'm currently configuring a router. I'm setting the default policies
> to DROP in the INPUT OUTPUT AND FORWARD chains. I'm thinking of
> setting the default FORWARD policy to ACCEPT as my default INPUT
> policy is DROP and unless there is a valid FORWARD rule for a given
> port the packets wont go anywhere. I'm I right on this? or could
> someone deliberately setup a packet to be forwarded from my router to
> my lan? all I could find on google was one similar question with no
> answer :(

FORWARD and INPUT are completely different.
INPUT is for packets that are in the end are destined for the host (i.e. 
routed to the host).

FORWARD is for packets, that are only forwarded by the host, the packets 
will not go through the INPUT chain.


In a normal routed network this depends on the destination IP of the 
packet, but if you DNAT the packets in the PREROUTING chain of the nat 
table the destination IP will change.


-- 
дамјан