0

Currently the NAT host and respective clients are able to access any service. I like the NAT host (the device running IPTABLES) to only be able to access HTTP(S), DNS and send/respond to ICMP requests.

I would like the internal clients behind $INTIF to only access HTTP(S) and DNS. I tried multiport but I had little luck. I'm open to other suggestions.

*nat
-A POSTROUTING -o "$EXTIF" -j MASQUERADE
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -p tcp -i eth1 --dport 22 --sport 1024:65535 -m state --state NEW -j ACCEPT
-A INPUT -i "$INTIF" -p udp --dport 53 -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m limit --limit 3/min -j LOG --log-prefix "input denied: " --log-level 7

-A FORWARD -i "$EXTIF" -o "$INTIF" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i "$INTIF" -o "$EXTIF" -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i "$INTIF" -o "$EXTIF" -m multiport -p tcp --dports 80,443 -j ACCEPT
-A FORWARD -m limit --limit 3/min -j LOG --log-prefix "forward denied: " --log-level 7

-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m limit --limit 3/min -j LOG --log-prefix "output denied: " --log-level 7
COMMIT

1 Answer 1

1

Remove "NEW" from the second FORWARD rule (this is what is accepting all outgoing connections).

The third and fourth forward rules should be something like

-A FORWARD -i "$INTIF" -o "$EXTIF" -m multiport -p tcp --dports 80,443,53 -j ACCEPT
-A FORWARD -i "$INTIF" -o "$EXTIF" -p udp --dport 53 -j ACCEPT

As an aside, your default INPUT policy is accept, so after logging "input denied" the packet is accepted anyway.

4
  • I updated the rule set with your recommendations but the internal clients are unable to connect to HTTP after doing so. I have updated the original post to reflect the changes that were made.
    – Astron
    Jun 10, 2011 at 15:01
  • @Astron Is it logging the attempts as "forward denied"?
    – DerfK
    Jun 10, 2011 at 15:36
  • @DerflK My mistake, the NAT host is also acting as a DNS forwarder so I added the appropriate rule to the INPUT chain to allow for resolution. I assume 53/TCP will not be need as the clients will not be receiving zone transfers. Lastly, should I use a similar method to lock-down the host on the INPUT and OUTPUT chains?
    – Astron
    Jun 10, 2011 at 16:23
  • 1
    TCP is used for any query (or its results) that will not fit in a UDP packet. The host looks fairly locked down from the outside now that deny is default. It can still connect out to anything so depending on your situation you may want to lock it down further on the OUTPUT chain. If you remove the NEW there you'll need to be sure to allow outgoing DNS plus whatever else that server needs to connect to on both networks.
    – DerfK
    Jun 10, 2011 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .