I am trying to create a firewall rule on an Ubuntu 10.04 server running isc-dhcpd. I only want dhcp to be accessible by a single relay host (220.127.116.11). I have iptables set up like so:
# iptables -vnL Chain INPUT (policy ACCEPT 5325 packets, 523K bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- * * 18.104.22.168 0.0.0.0/0 udp dpt:67 1497 533K DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
This is my attempt to drop all UDP traffic destined to port 67 unless it's coming from 22.214.171.124.
However, with this rule in place, when I start the dhcpd I immediately see DHCP requests start to come in via broadcast (the log says via eth0).
Do I need another firewall rule to catch the broadcast traffic? I've tried adding a rule like
iptables -A INPUT -p udp -d 255.255.255.255 -j DROP
which should drop all UDP broadcast traffic. But again when I start dhcpd I see tons of requests via broadcast.
EDIT: According to this page:
For most operations, DHCP software interfaces to the Linux IP stack at a level below Netfilter. Hence, Netfilter (and therefore Shorewall) cannot be used effectively to police DHCP.
So is there any way to accomplish what I want here?