iptables -A FORWARD -s 192.168.20.7 -d 10.10.48.3 -p tcp --dport 25 -o eth1 -j ACCEPTiptables -A FORWARD -s 10.10.48.3 -d 192.168.20.7 -p tcp --sport 25 -i eth1 -j ACCEPTTuning the firewall of my organization I found these two lines which confused me. The eth1 interface is connected to the 10.10.x.x network, so... does it make sense to put the -o eth1 and the -i eth1 if that is already implied by the -d 10.10.48.3 and -s 10.10.48.3, respectively?
Does -o and -i make sense when the target host is already connected to the interface specified?
iptables;firewall
Based on the man page for iptables I'd be inclined to agree with your assessment as well.   [!] -i, --in-interface name        Name of an interface via which a packet was received (only for         packets entering the INPUT, FORWARD and PREROUTING chains).  When         the ! argument is used before the interface name, the sense is         inverted.  If the interface name ends in  a  +,  then  any          interface which begins with this name will match.  If this option        is omitted, any interface name will match.   [!] -o, --out-interface name        Name of an interface via which a packet is going to be sent (for         packets entering the FORWARD, OUTPUT and POSTROUTING chains).  When        the ! argument is used before the interface name, the sense is         inverted.  If the interface name ends in a +, then any  interface        which begins with this name will match.  If this option is omitted,         any interface name will match.The last sentence in those descriptions is really the only point of concern. If there are other interfaces on the box traffic could be allowed by this rule to make use it, with the -o or -i options omitted. This is all assuming that the routing and such is setup to allow for that to even happen.