2

I'm trying to setup IPTABLES on my xen host server that will block incoming and/or outgoing access to a xen client on the same machine. Specifically, I need to block outgoing port 25 traffic and incoming port 53 traffic to a specific container.

Regular IPTABLE rules only appear to affect traffic going to the host -- not the xen client.

For my server, eth0 is the internal network, eth1 is the external.

The following rule set seems like it should work, but the container is not affected at all:

iptables -A OUTPUT -p tcp -m state –state NEW,ESTABLISHED,RELATED –sport 25 -d  -j REJECT
iptables -A INPUT -p tcp -m state –state NEW,ESTABLISHED,RELATED –dport 53 -d  -j REJECT
iptables -A INPUT -p udp -m state –state NEW,ESTABLISHED,RELATED –dport 53 -d   -j REJECT

So basically, how do I setup an IPTABLE rule that will apply to the xen client instead of the xen host?

Thanks

3
  • Provided that the vm is using it's own IP, you should do all the filtering in the FORWARD chain, not the INPUT/OUTPUT (such behaviour would have worked with ipchains but is not valid for netfilter).
    – O G
    Aug 17, 2011 at 5:40
  • I tried the following (to block all traffic to a client) and it did not work: -A FORWARD -p tcp -m state --state NEW,ESTABLISHED,RELATED -d [CLIENT_IP] -j REJECT
    – John P
    Aug 17, 2011 at 6:45
  • Can you provide some details on hosts and vm's network configuration (substitute the first 3 bytes in each ip with 1.2.3 for privacy, but provide interface names and correct masks)?
    – O G
    Aug 17, 2011 at 6:59

3 Answers 3

1

This rule worked ion my installation:

iptables -I FORWARD 1 -d [client-ip] -p tcp -m tcp --dport 53 -j DROP
iptables -I FORWARD 1 -d [client-ip] -p udp -m udp --dport 53 -j DROP

Notice that netfilter reads rules top-to-bottom and if you have a rule permitting all traffic to this client above (iptables -A adds rule to the end of the table), this new rule won't be reached and won't have effect.

I didn't understand why you use "state" module if you a listing all valid states? It just uses CPU time and has no effect IMHO.

Next, I'm not sure, what is the goal of blocking traffic, going from port 25. If you client sends ab e-mail, he connects to remote server's port 25 but uses one of local ports (32k..64k by default) on his side. Couldn't you explain, what do you want to get as a result?

3
  • My goal with the port 25 rule is to prevent a container from sending sending email
    – John P
    Aug 17, 2011 at 11:55
  • Then you should forbid destination port 25.
    – HUB
    Aug 17, 2011 at 13:03
  • Ex. iptables -I FORWARD 1 -s [client-ip] -p tcp -m tcp --dport 25 -j DROP
    – HUB
    Aug 17, 2011 at 13:04
1

You can play with "physdev" module of iptables. But remember that xen inserts (i.e. places it at the beginning of firewall rules list) full-access rules on guest start. So, you should tune xen logic.

My own simple firewall for xen host with huests:

#!/bin/bash

# ====== Public settings ======

LAN='192.168.0.0/24'
WAN='0.0.0.0/0.0.0.0'

HOST_IP='192.168.0.20'    

ADMIN_PORTS='22,873'

DB_IP='192.168.0.6'
MYSQL_PORTS='3306'
DB_PORTS="$ADMIN_PORTS,$MYSQL_PORTS"

WS_IP='192.168.0.10'
WS_PORTS="$ADMIN_PORTS,80"

WS2_IP='192.168.0.9'
WS2_PORTS="$ADMIN_PORTS,8082"

XP_IP='192.168.0.7'
XP_PORTS="$ADMIN_PORTS,3389,6666,6688,12345"


# ====== Private settings ======

IPTABLES='/sbin/iptables'

clearTables()
{
        $IPTABLES -t filter -P INPUT ACCEPT
        $IPTABLES -t filter -P FORWARD ACCEPT
        $IPTABLES -t filter -P OUTPUT ACCEPT

        $IPTABLES -t nat -P PREROUTING ACCEPT
        $IPTABLES -t nat -P POSTROUTING ACCEPT
        $IPTABLES -t nat -P OUTPUT ACCEPT

        $IPTABLES -t mangle -P PREROUTING ACCEPT
        $IPTABLES -t mangle -P INPUT ACCEPT
        $IPTABLES -t mangle -P OUTPUT ACCEPT
        $IPTABLES -t mangle -P FORWARD ACCEPT
        $IPTABLES -t mangle -P POSTROUTING ACCEPT

        $IPTABLES -t filter -F
        $IPTABLES -t nat -F
        $IPTABLES -t mangle -F

        $IPTABLES -t filter -X
        $IPTABLES -t nat -X
        $IPTABLES -t mangle -X
}

listTables(){
        for table in filter nat mangle; do
                echo "=========== $table ============";
                $IPTABLES -t $table -n -L;
                echo;
        done
}

clearTables

PHYSDEV='-m physdev --physdev-is-bridged'


# ====== Firewall logic ======

#========= Common permissions for host machine ==========
$IPTABLES -A FORWARD $PHYSDEV -p ALL -s $HOST_IP -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV -p ALL -d $HOST_IP -j ACCEPT


# ======= For all (guests) =======

# DNS
$IPTABLES -A FORWARD $PHYSDEV -p udp --dport 53 -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV -p udp --sport 53 -j ACCEPT

# ping
#$IPTABLES -A FORWARD $PHYSDEV -p icmp -s $DB_IP -d $LAN -j REJECT
$IPTABLES -A FORWARD $PHYSDEV -p icmp -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV -p icmp -j ACCEPT


#======= DB server ======

# LAN <--> admin ports
$IPTABLES -A FORWARD $PHYSDEV -s $LAN -d $DB_IP -p tcp -m multiport --dports $ADMIN_PORTS -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV  -s $DB_IP -d $LAN -p tcp -m multiport --sports $ADMIN_PORTS -j ACCEPT

# MySQL between WS and DB
$IPTABLES -A FORWARD $PHYSDEV -s $WS_IP -d $DB_IP -p tcp -m multiport --dports $MYSQL_PORTS -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV -s $DB_IP -d $WS_IP -p tcp -m multiport --sports $MYSQL_PORTS -j ACCEPT


#======== WS ========
# LAN <--> admin ports
$IPTABLES -A FORWARD $PHYSDEV -s $LAN -d $WS_IP -p tcp -m multiport --dports $ADMIN_PORTS -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV  -s $WS_IP -d $LAN -p tcp -m multiport --sports $ADMIN_PORTS -j ACCEPT
# HTTP-порт
$IPTABLES -A FORWARD $PHYSDEV -s $LAN -d $WS_IP -p tcp -m multiport --dports $WS_PORTS -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV -s $WS_IP -d $LAN -p tcp -m multiport --sports $WS_PORTS -j ACCEPT


#======== WS2 =======
# LAN <--> admin ports
$IPTABLES -A FORWARD $PHYSDEV -s $LAN -d $WS2_IP -p tcp -m multiport --dports $ADMIN_PORTS -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV  -s $WS2_IP -d $LAN -p tcp -m multiport --sports $ADMIN_PORTS -j ACCEPT
# HTTP-ports
$IPTABLES -A FORWARD $PHYSDEV -s $LAN -d $WS2_IP -p tcp -m multiport --dports $WS2_PORTS -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV -s $WS2_IP -d $LAN -p tcp -m multiport --sports $WS2_PORTS -j ACCEPT


#======== WIN_XP =======
# LAN <--> admin ports
$IPTABLES -A FORWARD $PHYSDEV -s $LAN -d $XP_IP -p tcp -m multiport --dports $ADMIN_PORTS -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV  -s $XP_IP -d $LAN -p tcp -m multiport --sports $ADMIN_PORTS -j ACCEPT
# HTTP-ports
$IPTABLES -A FORWARD $PHYSDEV -s $LAN -d $XP_IP -p tcp -m multiport --dports $XP_PORTS -j ACCEPT
$IPTABLES -A FORWARD $PHYSDEV -s $XP_IP -d $LAN -p tcp -m multiport --sports $XP_PORTS -j ACCEPT


#========== Common ban to LAN for guests ==========
$IPTABLES -A FORWARD $PHYSDEV -p ALL -d $LAN -j DROP
$IPTABLES -A FORWARD $PHYSDEV -p ALL -s $LAN -j DROP
0

I rarely try to block DomU VM's so I can't tell you exactly what to do. But please refer to this page:

http://wiki.xensource.com/xenwiki/XenNetworking

especially the "Bridging" section. There are some iptables examples there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .