I'm trying work on a positive firewall and block the rest of the world with iptables. So, I've set INPUT chain default to DROP, allowing particular IPs which should have access.


iptables -P INPUT DROP

However, I'll have to enable connections for downloads, updates etc. From what I understand, this can be accomplished by accepting ESTABLISHED,RELATED connections via state or conntrack module. Say,

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# ---OR---
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

At this point, I wonder if there is an alternative way of getting connections(like downloads) working without making use of a complex module like state or conntrack. If at all possible, I like to stick on with basic iptables stuff to avoid getting messy during a possible attack.

Appreciate some thoughts/inputs. Thanks!

  • 1
    What do you mean by "connections for downloads, updates etc."? – MadHatter Jul 12 '14 at 7:30
  • Setting iptables INPUT chain to DROP all connections means it won't accept incoming packets. This will leave the system in a state which it won't even ping an unknown host. This will break system updates(via yum,apt-get etc.). Or will block file downloads from Internet(Anything, say http, ftp links). – shad Jul 12 '14 at 7:56
  • I know what you mean by refusing things you don't want; that's easy. I need you to itemise the things you do want. There is no firewall software on earth that can read your mind and decide what sort of (layer-3) traffic you have a business need for, and what you don't - you have to do that. – MadHatter Jul 12 '14 at 8:05
  • 2
    conntrack really is not a significant worry unless you're trying to run a firewall on an ancient wristwatch or something. Even on a modern phone the overhead is minimal. – Michael Hampton Jul 12 '14 at 13:31

Setting the chain INPUT to DROP does not break anything at all, you can still update your system (this is an OUTPUT connection) and allow file downloads (just open the port relevant to the service providing that file).

The DROP means traffic will be dropped unless there is a rule stating something else. Also, using the conntrack module is a pretty standard way of managing your iptables rules.

If the purpose of your firewall is to accept traffic only from a known group of IPs/ranges, and you want to avoid editing your rules every time that group changes, you can use an ipset.

  • 2
    I can't really understand why do you think using conntrack adds complexity to a set of rules. Also, conntrack is made to track connections. No workaround needed. You are already using the right tool. – dawud Jul 12 '14 at 9:21
  • I'm searching if there is a workaround since using conntrack/state implies that firewall is parsed by single core. Besides, both use some messy locking inside kernel to track the state. It's working fine, but I'm thinking of improvements. – shad Jul 12 '14 at 9:30
  • What kind of throughput are we talking about here? How many rules? – dawud Jul 12 '14 at 9:32
  • 500+ allow rules and counting. – shad Jul 12 '14 at 14:24
  • 1
    If you have that many rules because you need to allow traffic from many different IPs/ranges, ipsets can greatly reduce the overhead. – dawud Jul 12 '14 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.