File: //usr/share/doc/iptables/html/packet-filtering-HOWTO-5.html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
<META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.82">
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<TITLE>Linux 2.4 Packet Filtering HOWTO: Rusty's Really Quick Guide To Packet Filtering</TITLE>
<LINK HREF="packet-filtering-HOWTO-6.html" REL=next>
<LINK HREF="packet-filtering-HOWTO-4.html" REL=previous>
<LINK HREF="packet-filtering-HOWTO.html#toc5" REL=contents>
</HEAD>
<BODY>
<A HREF="packet-filtering-HOWTO-6.html">Next</A>
<A HREF="packet-filtering-HOWTO-4.html">Previous</A>
<A HREF="packet-filtering-HOWTO.html#toc5">Contents</A>
<HR>
<H2><A NAME="s5">5.</A> <A HREF="packet-filtering-HOWTO.html#toc5">Rusty's Really Quick Guide To Packet Filtering</A></H2>
<P>Most people just have a single PPP connection to the Internet, and
don't want anyone coming back into their network, or the firewall:</P>
<P>
<BLOCKQUOTE><CODE>
<PRE>
## Insert connection-tracking modules (not needed if built into kernel).
# insmod ip_conntrack
# insmod ip_conntrack_ftp
## Create chain which blocks new connections, except if coming from inside.
# iptables -N block
# iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
# iptables -A block -j DROP
## Jump to that chain from INPUT and FORWARD chains.
# iptables -A INPUT -j block
# iptables -A FORWARD -j block
</PRE>
</CODE></BLOCKQUOTE>
</P>
<HR>
<A HREF="packet-filtering-HOWTO-6.html">Next</A>
<A HREF="packet-filtering-HOWTO-4.html">Previous</A>
<A HREF="packet-filtering-HOWTO.html#toc5">Contents</A>
</BODY>
</HTML>