# Problem iptables-1.4.11.1-r2 (FORWARD)

## sebad

Some days ago I updated iptables to version 1.4.11.1-r2 (stable), but after update internet at workstations stopped working. No changes in config file has been made after update. This is part of my config: 

```

*filter 

:INPUT DROP [0:0] 

:FORWARD ACCEPT [0:0] 

:OUTPUT ACCEPT [0:0] 

-A INPUT -i lo -j ACCEPT 

-A FORWARD -s 192.168.151.0/24 -j ACCEPT 

```

After few minutes fight I figured out, thet problem is in blocking packets in FORWARD filter. After changind FORWARD default rule from DROP to ACCEPT everything is working fine. Question: why the command 

```

iptables -t filter -A FORWARD -s 192.168.151.0/24 -j ACCEPT 

```

doesn't work ? Bug in iptables? I don't think so...

----------

## truc

```
iptables -t filter -A FORWARD -s 192.168.151.0/24 -j ACCEPT 
```

is not enough!

What about the replies?

add something like

```
iptables -t filter -A FORWARD -d 192.168.151.0/24 -m state --state RELATED,ESTABLISHED -j ACCEPT 
```

then try to set your default policy to DROP in the FORWARD chain

----------

## sebad

It doesn't work...

This is my whole config.

```
*nat

#INTERNET SHARING

-A POSTROUTING -s 192.168.151.0/24 -j SNAT --to-source 217...

-A POSTROUTING -s 192.168.152.0/24 -j SNAT --to-source 217...

COMMIT

*filter

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -i lo -j ACCEPT

-A FORWARD -s 192.168.151.0/24 -j ACCEPT

-A FORWARD -s 192.168.152.0/24 -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p tcp --dport 5001 -j ACCEPT

-A INPUT -p tcp --dport 3128 -j ACCEPT

-A INPUT -p tcp --dport 22 -j ACCEPT

-A INPUT -p tcp --dport 21 -j ACCEPT

-A INPUT -p icmp -j ACCEPT

#PPTPD

-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT

#Samba

-A INPUT -m state --state NEW -p tcp -m tcp --dport 137 -j ACCEPT

-A INPUT -m state --state NEW -p udp -m udp --dport 137 -j ACCEPT

-A INPUT -m state --state NEW -p tcp -m tcp --dport 138 -j ACCEPT

-A INPUT -m state --state NEW -p udp -m udp --dport 138 -j ACCEPT

-A INPUT -m state --state NEW -p tcp -m tcp --dport 139 -j ACCEPT

-A INPUT -m state --state NEW -p udp -m udp --dport 139 -j ACCEPT

-A INPUT -m state --state NEW -p tcp -m tcp --dport 445 -j ACCEPT

COMMIT

```

----------

## truc

I don't see the rule I invited you to add in there

Note: If your rules for 192.168.151.0/24 and 192.168.152.0/24 are similar, then you can combine them using this subnet instead 192.168.150.0/23

----------

