Nat for two private subnets with subnet routing

Hello All,

I'm having a bit of trouble setting up a linux router with two private subnets. Each subnet can access the internet, but they cannot communicate with each other. I've include my rules. Any and all advice would be greatly appreciated.

Thanks in advance,
-G

### setup networking ############################################ LAN_IP1="10.10.10.1/24"

LAN_IP2="10.10.11.254/24"

echo "Bringing down interfaces"

# bring down interfaces

ip link set $WAN_IFACE down

ip link set $LAN_IFACE1 down

ip link set $LAN_IFACE2 down

echo "Setting interface addresses"

# set interface addresses

ip addr add $WAN_IP dev $WAN_IFACE

ip addr add $LAN_IP1 dev $LAN_IFACE1

ip addr add $LAN_IP2 dev $LAN_IFACE2

echo "Cleanup iptables"

# clean up the tables

iptables -F

iptables -X

iptables -Z

echo "Setting default policies"

# Set the default policies

iptables -P INPUT DROP

iptables -P OUTPUT DROP

iptables -P FORWARD DROP

echo "Bringing up interfaces"

# bring up interfaces

ip link set $WAN_IFACE up

ip link set $LAN_IFACE1 up

ip link set $LAN_IFACE2 up

echo "Adding default route"

# add default route

ip route add default via $INET_ROUTER dev eth0

echo "Enable forwarding"

# Enable ip_forward

echo "1" > /proc/sys/net/ipv4/ip_forward

### setup firewall
#######################################################

# Let stuff on the local loopback through

iptables -A INPUT -i lo -j ACCEPT

iptables -A OUTPUT -o lo -j ACCEPT

echo "Setup SNAT..."

# Source NAT

iptables -t nat -A POSTROUTING -s 10.10.11.0/24 -j SNAT --to $WAN_IP

echo "Accept internal addresses"

# packets with valid internal address are accepted on $LAN_IFACE

iptables -t mangle -A PREROUTING -i $LAN_IFACE1 -s $INTERNAL_ADDRESS_RANGE1 -j ACCEPT

iptables -t mangle -A PREROUTING -i $LAN_IFACE2 -s $INTERNAL_ADDRESS_RANGE2 -j ACCEPT

#iptables -t mangle -A PREROUTING -i $LAN_IFACE1 -s $INTERNAL_ADDRESS_RANGE2 -j ACCEPT

#iptables -t mangle -A PREROUTING -i $LAN_IFACE2 -s $INTERNAL_ADDRESS_RANGE1 -j ACCEPT

# no packets with $LAN_IP accepted on $WAN_IFACE

iptables -t mangle -A PREROUTING -i $WAN_IFACE -s $INTERNAL_ADDRESS_RANGE1 -j DROP

iptables -t mangle -A PREROUTING -i $WAN_IFACE -s $INTERNAL_ADDRESS_RANGE2 -j DROP

# allow connections to firewall from LAN

iptables -A INPUT -p ALL -i $LAN_IFACE1 -s $INTERNAL_ADDRESS_RANGE1 -d $LAN_BCAST_ADDRESS1 -j ACCEPT

iptables -A INPUT -p ALL -i $LAN_IFACE2 -s $INTERNAL_ADDRESS_RANGE2 -d $LAN_BCAST_ADDRESS2 -j ACCEPT

iptables -A OUTPUT -o $WAN_IFACE -j ACCEPT

# First off, allow through standard subnet-subnet traffic. It doesn't need

# to be logged, so get it out of there

# Accept the traffic to and from the subnets

iptables -A FORWARD -p all -s $INTERNAL_ADDRESS_RANGE1 -d $INTERNAL_ADDRESS_RANGE1 -j ACCEPT

iptables -A FORWARD -p ALL -s $INTERNAL_ADDRESS_RANGE2 -d $INTERNAL_ADDRESS_RANGE2 -j ACCEPT

#iptables -A FORWARD -p ALL -s $INTERNAL_ADDRESS_RANGE1 -d $INTERNAL_ADDRESS_RANGE2 -j ACCEPT

#iptables -A FORWARD -p ALL -s $INTERNAL_ADDRESS_RANGE2 -d $INTERNAL_ADDRESS_RANGE1 -j ACCEPT

# Put in a syn flood rule to stop people from a DOS attack

# Commented out while testing things

iptables -N syn-flood

iptables -A FORWARD -p tcp --syn -j syn-flood

iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN

iptables -A syn-flood -j DROP

# Allow new connections out (And logged for interest sake)

#iptables -A FORWARD -p tcp -s $INTERNAL_ADDRESS_RANGE --syn -m state --state NEW -j LOG --log-prefix "New connection: "

iptables -A FORWARD -p tcp -s $INTERNAL_ADDRESS_RANGE1 --syn -m state --state NEW -j ACCEPT

iptables -A FORWARD -p tcp -s $INTERNAL_ADDRESS_RANGE2 --syn -m state --state NEW -j ACCEPT

# allow all DNS traffic out

iptables -A FORWARD -p udp -s $INTERNAL_ADDRESS_RANGE1 -j ACCEPT

iptables -A FORWARD -p udp -s $INTERNAL_ADDRESS_RANGE2 -j ACCEPT

# And accept established connections

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Also don't allow fragments - they're bad

iptables -A FORWARD -f -j LOG --log-prefix "IP Fragment: "

iptables -A FORWARD -f -j DROP

# Allow ping out (but not in)

iptables -A FORWARD -p icmp -s $INTERNAL_ADDRESS_RANGE1 -j ACCEPT

iptables -A FORWARD -p icmp -s $INTERNAL_ADDRESS_RANGE2 -j ACCEPT

# And in this bit we'll put the things we do allow in

# Allow web requests to web server

iptables -A FORWARD -p tcp -d $WWW --dport 80 -j ACCEPT

# FTP connections to ftp server

iptables -A FORWARD -p tcp -d $FTP --dport 21 -j ACCEPT

# Allow incoming mail

iptables -A FORWARD -p tcp -d $MAIL --dport 25 -j ACCEPT

# DNS lookups to DNS

iptables -A FORWARD -p tcp -d $DNSa --dport 53 -j ACCEPT

iptables -A FORWARD -p udp -d $DNSa --dport 53 -j ACCEPT

# And DNS requests to Secondary DNS

iptables -A FORWARD -p tcp -d $DNSb --dport 53 -j ACCEPT

iptables -A FORWARD -p udp -d $DNSb --dport 53 -j ACCEPT

# Log and drop stuff

iptables -A FORWARD -p tcp -j LOG --log-prefix "Dropped TCP: "

iptables -A FORWARD -p tcp -j DROP

iptables -A FORWARD -p udp -j LOG --log-prefix "Dropped UDP: "

iptables -A FORWARD -p udp -j DROP

iptables -A FORWARD -p icmp -j LOG --log-prefix "Dropped ICMP: "

iptables -A FORWARD -p icmp -j DROP

# This is to really make sure things disappear

iptables -A FORWARD -j LOG --log-prefix "End Forward chain - Dropped: "

iptables -A FORWARD -j DROP

I believe that this rule:

would benefit from specifying that it only applies to packets leaving via $WAN_IFACE, otherwise it is going to SNAT packets from LAN1 to LAN2 and apply the source address of $WAN_IP, which is probably not what you want?

Why are you bothering to specify ACCEPT rules in the mangle table?

I do not agree with DROPping packets in the mangle table. DROP is a
filtering action, and belongs in the filter tables.

I do not understand the above two rules. Are internal address range1 and 2
the subnets on LAN1 and LAN2? If so, packets between same-subnet addresses
are not going to pass through your firewall. If not, what are they?

I suggest you firstly identify whether you have a routing problem or a firewalling problem.
Disconnect the machine from the WAN link to the Internet, flush all rules in all tables and apply default ACCEPT policies to all chains, then see if LAN1 can communicate with LAN2.
If they can, start with a simple ruleset and build up gradually so that you can find out which rule/s break the inter-LAN routing.
If they cannot, then your problem is a routing problem, not netfilter, and I suggest you check the routing table on the firewall.

If you want further help, please post the output of: "iptables -L -nvx; iptables -L -t nat -nvx; iptables -L -t mangle -nvx; route -n".

Regards,

Antony.

If builders made buildings the way programmers write programs, then the first 
woodpecker to come along would destroy civilisation.

                                                     Please reply to the list;
                                                           please don't CC me.

Antony has given some excellent advice here and has identified your problem as doing NAT on your internal traffic. I learn quite a bit from Antony but would contest one statement he makes. After testing and corroboration from other experienced members of this list, I do recommend dropping malicious packets as soon as possible and that means in the mangle table. Other, more generic DROP rules I, of course, put in the filter table but rules regarding bad tcp flags, spoofs, etc., I put in mangle. Take care, all - John

John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
[email protected]
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net 

Hi all,

I've got a big problem with my firewall which have three ethernet cards. eth0 : 172.16.2.1/255.255.255.0 ---->LAN
eth1: 192.168.2.1/255.255.255.0----->DMZ
eth2: 192.168.3.1/255.255.255.0-----> WAN

This firewall is connect to a router which have Wan IP 192.168.3.254 and a public IP for WAN : 62.160.X.X/255.255.255.255
This configurations is working !!!

I have tried to replace the Wan IP of my firewall by a public IP : 62.160.X.Y

# ifconfig eth2 62.160.X.Y netmask 255.255.255.248
# route add default gw 62.160.X.Z (which is new Ip of the router (WAN and LAN 
interfaces of the router are the same)

I can access to the internet from my firewall but unfortunately not from my LAN.
So now I come back to my old configuration until I ask why it was not working. Have you got any idea please ?

My iptables script is :

iptables -t filter -F
iptables -t nat -F

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

###########
# FORWARD #
###########

			##############
			# LAN -->DMZ #
			##############

iptables -t nat -A PREROUTING -d 172.16.2.1 -p tcp --dport 110 -j DNAT --to-destination 192.168.2.150:110
iptables -t filter -A FORWARD -i eth0 -o eth1 -s 172.16.0.0/16 -d 192.168.2.150/32 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth1 -o eth0 -s 192.168.2.150/32 -d 172.16.0.0/16 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT

			###############
			# LAN --> WAN #
			###############

####################################
# PROTOCOLE IDENT : TCP et UDP 113 #
####################################
iptables -t filter -A FORWARD -p tcp --dport 113 -j ACCEPT iptables -t filter -A FORWARD -p tcp --sport 113 -j ACCEPT iptables -t filter -A FORWARD -p udp --dport 113 -j ACCEPT iptables -t filter -A FORWARD -p udp --sport 113 -j ACCEPT

###################################
# HTTP, HTTPS : TCP 80 et TCP 443 #
###################################
iptables -t filter -A FORWARD -i eth0 -o eth2 -s 172.16.0.0/16 -d 0/0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -o eth0 -s 0/0 -d 172.16.0.0/16 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o eth2 -s 172.16.0.0/16 -d 0/0 -p tcp --dport 443 -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -o eth0 -s 0/0 -d 172.16.0.0/16 -p tcp --sport 443 -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o eth2 -s 172.16.0.0/16 -d 0/0 -p udp --dport 443 -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -o eth0 -s 0/0 -d 172.16.0.0/16 -p udp --sport 443 -j ACCEPT

##################
# Protocole POP3 #
##################

iptables -t filter -A FORWARD -i eth0 -o eth2 -s 172.16.0.0/16 -d 0/0 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -o eth0 -s 0/0 -d 172.16.0.0/16 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT

#################
# Protocole FTP #
#################

modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

iptables -t filter -A FORWARD -s 172.16.0.0/16 -d 0/0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -s 0/0 -d 172.16.0.0/16 -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -s 172.16.0.0/16 -d 0/0 -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -s 0/0 -d 172.16.0.0/16 -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s 172.16.0.0/16 -d 0/0 -p tcp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -t filter -A FORWARD -s 0/0 -d 172.16.0.0/16 -p tcp --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

iptables -t filter -A INPUT -j DROP
iptables -t filter -A OUTPUT -j DROP
iptables -t filter -A FORWARD -j DROP

Thanks

Fred99

This means that your WAN router must be doing SNAT for you on packets to the Internet, and the corresponding DNAT on packets coming back again.

Yes; if you want to use your WAN router in bridging mode (which it is if you have the same address on both internal and external interfaces) with a public IP on your firewall, then you need to SNAT outbound packets (which will automatically DNAT reply packets for you too):

iptables -A POSTROUTING -t nat -o eth2 -j DNAT --to 62.160.X.Y

Regards,

Antony.

This email was created using 100% recycled electrons.

                                                     Please reply to the list;
                                                           please don't CC me.

Thanks for your answer but if I understand whant you mean, I have only to add the following line in my iptables script :
iptables -A POSTROUTING -t nat -o eth2 -j DNAT --to 62.160.X.Y With this line the computers on my LAN and my DMZ will allow to exit to the Internet ??

With the two following lines will it work ?
iptables -t nat POSTROUTING -s 172.16.0.0/16 -o eth2 -j MASQUERADE iptables -t nat POSTROUTING -s 192.168.2.0/24 -o eth2 -j MASQUERADE

Thanks

Frederic

Please note the correction posted by Jason Opperisano - I typed a D instead of an S:

iptables -A POSTROUTING -t nat -o eth2 -j SNAT --to 62.160.X.Y

Yes.

Yes, that would work as well, but:

1. Why do you want to specify the source addresses? Do you have any other
subnets on the inside of your firewall (if not, why bother to specify, if yes, don't you want those other addresses to have access to the Internet?)

2. Do you have a dynamic (DHCP) address on eth2? If so, then MASQUERADE is
the correct target, but if ti's a static address, SNAT is marginally more efficient.

Regards,

Antony.

If J. Random Websurfer clicks on a button that promises dancing pigs on his 
computer monitor, and instead gets a hortatory message describing the 
potential dangers of the applet - he's going to choose dancing pigs over 
computer security any day. If the computer prompts him with a warning screen 
like: "The applet DANCING PIGS could contain malicious code that might do 
permanent damage to your computer, steal your life's savings, and impair your 
ability to have children," he'll click "OK" without even reading it. Thirty 
seconds later he won't even remember that the warning screen even existed.

 - Bruce Schneier "Secrets and Lies"

                                                     Please reply to the list;
                                                           please don't CC me.

Thanks Antony,

According to your explanations I think I 'd rather to include the following line in my iptable script :
iptables -A POSTROUTING -t nat -o eth2 -j SNAT --to 62.160.X.Y

But to be sure : I've got two computers on my DMZ which have IP included in 192.168.2.0/255.255.255.0 and other computers on my LAN which have IP included in 172.16.0.0/255.255.0.0 and static public IP on my WAN Firewall. So the best way is to use the line you advice me ?
Where on my script do I have to add this line ? At the beginning, just after a modprobe iptable_nat line ?

Last question : Do you see some clumsy things or errors in my script ? Unfortunately I think there are .... ;-(

Thanks again for your help

Frederic

Yes.

I like to put it just before or just after the FORWARD rules, because it's for packets which are being routed through the firewall.

You have approximately twice as many rules as I would expect to see - you are allowing each individual protocol (defined by its source port)n in an ESTABLISHED rule; most people would just use one ESTABLISHED rule to allow all reply packets, no matter which protocol.

Also you have specific rules for FTP data connection on port 20 - better to just leave these out and handle the packets as RELATED to the control connection on port 21.

I prefer a simple ruleset if possible because it's easier to work with.

Regards,

Antony.

The difference between theory and practice is that in theory there is no 
difference, whereas in practice there is.

                                                     Please reply to the list;
                                                           please don't CC me.

Hi to all, I'm new in this mailing list. My interest is if there's anybody who knows a "Distributed Firewall" for PDA's who mount the Familiar distribution of Linux, even commercial or open source. Sorry for my English and thanks to all.

Hi all,

I've changed my external IP of my firewall (public IP now). I can access to the internet from my LAN but it's very very slow now. My bandwith looks good.
Have you got any idea ?

Thanks

Fred

What exactly do you mean by that last statement? I would have said that
"very very slow" and "bandwidth looks good" mean almost opposite things.

Where are your LAN machines getting their DNS from?
What are you using to test, and finding things "very very slow"? Do you see the same speed problem if you download something to the firewall as downloading to an internal LAN machine?
Are you seeing lots of packets matching your DROP rules?
Have you tried a packet sniffer to see if there are unreplied packets on your LAN or external link?

Regards,

Antony.

"I estimate there's a world market for about five computers."

 - Thomas J Watson, Chairman of IBM

                                                     Please reply to the list;
                                                           please don't CC me.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Friday 30 July 2004 05:22, Fred Wrote:

Please send us your Rules in nat and filter table .

- --
Marriage is the only adventure open to the cowardly.
-- Voltaire
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBDGZGdei4RgWTmzARAlFlAJ9tPcY6bkyR6AAE91fHktXQocv+0QCeOZPk y2mJIdujruW7sYx8NbKldZw=
=Ky3G
-----END PGP SIGNATURE-----

If I replace in my iptables script :
iptables -A POSTROUTING -t nat -o eth2 -j SNAT --to my_public_IP by
iptables -t nat POSTROUTING -o eth1 -j MASQUERADE

...I can access to the internet faster !

Have you got any idea ?

My ipatbles script is present in one of my mail (Firewall IP change title)

Thanks,

Fred

Which is your external interface? eth1 or eth2?

How are you measuring "faster"?

Where are your DNS servers?

Regards,

Antony.

In Heaven, the police are British, the chefs are Italian, the beer is Belgian, 
the mechanics are German, the lovers are French, the entertainment is 
American, and everything is organised by the Swiss.

In Hell, the police are German, the chefs are British, the beer is American, 
the mechanics are French, the lovers are Swiss, the entertainment is Belgian, 
and everything is organised by the Italians.

                                                     Please reply to the list;
                                                           please don't CC me.

Sorry, my external interface is eth2 (it's just an error when I wrote the mail).
Some pages takes lots of time to appear when I'm using the first line in my script. When I'm using the second one they appear immediately. My DNS server is on my LAN with a private IP address 172.16.2.200.

Regards,

Frederic

Please show us:

1. The exact rules you are referring to (no typos, no hidden addresses, the exact rules as they appear in the scripts).

2. The routing table (output of "route -n") of the firewall

3. The interface configuration (output of "ifconfig") from the firewall.

Regards,

Antony.

The words "e pluribus unum" on the Great Seal of the United States are from a 
poem by Virgil entitled "Moretum", which is about cheese and garlic salad 
dressing.

                                                     Please reply to the list;
                                                           please don't CC me.

1-My iptables rules are the following :
iptables -t filter -F
iptables -t nat -F

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

iptables -t nat POSTROUTING -o eth2 -j MASQUERADE

###########
# FORWARD #
###########

                        ##############
                        # LAN -->DMZ #
                        ##############

iptables -t filter -A FORWARD -i eth0 -o eth1 -s 172.16.0.0/16 -d 192.168.2.150/32 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth1 -o eth0 -s 192.168.2.150/32 -d 172.16.0.0/16 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT

                        ###############
                        # LAN --> WAN #
                        ###############

####################################
# PROTOCOLE IDENT : TCP et UDP 113 #
####################################
iptables -t filter -A FORWARD -p tcp --dport 113 -j ACCEPT iptables -t filter -A FORWARD -p tcp --sport 113 -j ACCEPT iptables -t filter -A FORWARD -p udp --dport 113 -j ACCEPT iptables -t filter -A FORWARD -p udp --sport 113 -j ACCEPT

###################################
# HTTP, HTTPS : TCP 80 et TCP 443 #
###################################
iptables -t filter -A FORWARD -i eth0 -o eth2 -s 172.16.0.0/16 -d 0/0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -o eth0 -s 0/0 -d 172.16.0.0/16 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o eth2 -s 172.16.0.0/16 -d 0/0 -p tcp --dport 443 -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -o eth0 -s 0/0 -d 172.16.0.0/16 -p tcp --sport 443 -j ACCEPT
iptables -t filter -A FORWARD -i eth0 -o eth2 -s 172.16.0.0/16 -d 0/0 -p udp --dport 443 -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -o eth0 -s 0/0 -d 172.16.0.0/16 -p udp --sport 443 -j ACCEPT

##################
# Protocole POP3 #
##################

iptables -t filter -A FORWARD -i eth0 -o eth2 -s 172.16.0.0/16 -d 0/0 -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -o eth0 -s 0/0 -d 172.16.0.0/16 -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT

#################
# Protocole FTP #
#################

modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

iptables -t filter -A FORWARD -s 172.16.0.0/16 -d 0/0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -s 0/0 -d 172.16.0.0/16 -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -s 172.16.0.0/16 -d 0/0 -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -s 0/0 -d 172.16.0.0/16 -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s 172.16.0.0/16 -d 0/0 -p tcp --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -t filter -A FORWARD -s 0/0 -d 172.16.0.0/16 -p tcp --sport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

iptables -t filter -A INPUT -j DROP
iptables -t filter -A OUTPUT -j DROP
iptables -t filter -A FORWARD -j DROP

2- My default route is the IP of the LAN interface of my router which is a public IP (62.160.X.X/255.255.255.248)

3- eth0 : 172.16.2.1/255.255.0.0

    eth1: 192.168.2.1/255.255.255.0
    eth2: 62.160.X.Y/255.255.255.248

Regards,

Frederic