iptables on dd-wrt for church network

Question

I'm attempting to set up a firewall on my church's WRT54GL running dd-wrt v24. I've not found many good guides at setting up a firewall, and nothing that seems to be recent enough with these routers.

Basically, I want to set the firewall to block all incoming traffic on the non-essential ports, restrict certain local computers from accessing a fileserver, and block a few outgoing ports.

I've tried messing around with fwbuilder (Firewall Builder) but have had no luck. I can get my changes to commit to the firewall but I can't seem to get them to actually work.

Anyone able to help?

Answer 1

I can't give you an exact answer, but the following should help and give you a rough idea.

Stopping the local clients acessing the file server may not be possible if they are on the same nertwork (i.e. in the same IP network and the same physical segment) as the packet will not need to traverse the router to travel between them. If they do need to go via the router then I have included a rule that I think will help.

I'm not familir with the wrt distro, so I am not sure where you should put these rules.

Order is important.

#Add these rules once
iptables -A FORWARD -j INPUT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp --icmp-type any -j ACCEPT
iptables -A INPUT -p 50 -j ACCEPT
iptables -A INPUT -p 51 -j ACCEPT
iptables -A INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#for each incoming tcp service you want to allow add one of these:
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport <allowed_port> -j ACCEPT

#for each incoming udp service you want to allow add one of these:
iptables -A INPUT -m state --state NEW -m udp -p udp --dport <allowed_port> -j ACCEPT

#for each local client that should not have fileserver access add one of these:
iptables -A INPUT -s <banned_local_ip> -d <filesrever> -j REJECT

#add these once
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

# if you only wanted to block the outgoing access for a given local IP to an 
# external service then you add one of these for each local client and external
# service combination
iptables -A OUTPUT -s <local_banned_IP> --dport <disallowed_port> -j REJECT

#for each outgoing service you want to block to all local host add one of these:
# this will block the service for every host on the network 
iptables -A OUTPUT --dport <disallowed_port> -j REJECT


#add this once to allow all other outgoing    
iptables -A OUTPUT -j ALLOW

If the fileserver is a linux host then just put iptables rules on the fileerver to reject the local hosts you dont want to have access.

Answer 2

This one is considered to be the "iptables bible", it shall cover all your needs.

As it says, if you have troubles understanding anything it states, it might be due to lack of general networking knowledge and you could use this book, which is considered the "networking bible" to improve.

Answer 3

This question and answer requires a medium/high level of iptables understanding. I can't give an "out of the box" solution, but I can give a couple of lines as an example from a firewall for an almost open wifi using openwrt on wrt54gl.

In this example the ports listed are allowed, any other, blocked:

DO NOT paste it blindly!!! This can lock you out:

#iptables -A forwarding_rule -i br-lan -p tcp -m multiport --dports port,port,port -j ACCEPT
#iptables -A forwarding_rule -i br-lan -j DROP

These lines are from /etc/firewall.user file on the wifi router.

Please make backups before changing things!
Please be prepared to rewrite the firmware!
Please, leave a backdoor over ssh or http in case these don't work.