I am trying to configure an ubuntu server to share internet access from eth0 to client systems on eth1 however I only want to allow access in/out on port 1688 and also resolve host names while blocking all other traffic in and out. I'm not sure what IPTable rules are needed to achieve this, hoping for any help.

[outside] <--- traffic on port 1688 ---> {eth0}[Ubuntu 11.10 server]{eth1} <-----> [Client systems]


To do this properly, you'll really want to learn iptables so that you can troubleshoot any problems that may arise. Otherwise, iptables may become a 'black box' to you because you don't understand how to use it and prove to yourself that the problem isn't with iptables. Don't be put off though, learning the basics of iptables really isn't that hard and if you're interested, there are many different tutorials howtos and cookbooks on the wonderful things you can do with iptables under your control (Google "upside down internet" for a comical example).

What you want to do comes down to 3 simple steps.

1) Append/Insert a rule to the FORWARD chain to accept TCP port 1688. If you require UDP access as well, add a similar rule but for UDP.

2) Append/Insert rules to accept TCP and UDP port 53 to the FORWARD chain.

3) Set the default policy on the FORWARD chain to DROP.

After a very basic crash course in iptables this should be fairly easy, don't be put off by the potential complexity because you won't need to know any of it for this, this is basic stuff.


You need to set up your server as a router and firewall between these two nets.

So set up the firewall FORWARD rules in the server to only allow 1688/tcp, 53/udp and 53/tcp to pass through the firewall in your router. And set up default policy for FORWARD to DROP or DENY. Try to use a tool like ufw or shorewall to set up a firewall. It is much easier than to use iptables directly.

Anyway, if you use iptables directly, you have to manually change in /etc/sysctl.conf file (or add a new file in /etc/sysctl.conf.d/) so that your computer starts to route IP messages between the two networks. Look for net.ipv4.ip_forward=1 to solve that.

Good instructions can be found in Ubuntu wiki.

  • Isn't it port 53, not 54? – Jeff Welling May 30 '12 at 1:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.