5. Rusty's Really Quick Guide To Packet Filtering Copied:

I will assume you've used Rusty's really quick guide to packet filtering and you already have 2 systems prepared for NAT. Check the Packet Filtering FAQ for more details.

'iptables -vL' will probably look something like this:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target      prot opt in     out     source               destination
 2434  219K block       all  --  any    any     anywhere             anywhere

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
11657 5137K block      all  --  any    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 2514 packets, 217214 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       icmp --  any    any     anywhere             anywhere           state INVALID

Chain block (2 references)
 pkts bytes target     prot opt in     out     source               destination
13579 5319K ACCEPT     all  --  any    any     anywhere             anywhere           state RELATED,ESTABLISHED
  512 37065 ACCEPT     all  --  !eth1  any     anywhere             anywhere           state NEW
    0     0 DROP       all  --  any    any     anywhere             anywhere

translated it will look something like this:

        iptables -N block
        iptables -A INPUT -j block
        iptables -A FORWARD -j block
        iptables -A OUTPUT -p icmp -m state --state INVALID -j DROP
        iptables -A block -m state --state RELATED,ESTABLISHED -j ACCEPT
        iptables -A block -i ! eth1 -m state --state NEW -j ACCEPT
        iptables -A block -j DROP

Don't forget to turn IP forwarding on, otherwise this probably won't work. On a redhat 7.[2|3] system after entering this you can simply type:

        iptables-save > /etc/sysconfig/iptables

This will create your iptables config file which will load automagically at every boot up.