0

I have a Linux PC which is behind 3 routers, of which 3rd one is internet gateway. This PC is running a software which listens on a TCP socket. Port is forwarded on all 3 routers to connect the software running on the PC from outside world. Is it possible to block all network traffic except connection from a couple of WAN IPs using iptables command? (Basically whitelisting the IP of remote PC's internet IP).

Somone suggested that I can use commands given below.

#Flush existing rules
iptables -F

# Set up default DROP rule for eth0
iptables -P INPUT DROP

# Allow connections from WAN
iptables -A INPUT -o eth0 -d <WAN IP1> -j ACCEPT
iptables -A INPUT -o eth0 -d <WAN IP2> -j ACCEPT

If the above approach is correct, is it safe from hackers?

0

Your rules are not valid. You are denying all incoming traffic! There is no other rule to allow any incoming traffic to this machine.

Also, you have only ACCEPT rules in OUTPUT chain. If the default policy for OUTPUT is ACCEPT, this means all is allowed.

You need to make sure you are using the right chain. If you are executing these commands on a router/gateway machine, you need to add your rules to FORWARD chain. If you are executing these commands on the machine you want to be restricted, you need to use INPUT chain.

The OUTPUT chain is useful to restrict the originating traffic from your machine which is not what you want.

1
0

Is it possible to block all network traffic except connection from a couple of WAN IPs using iptable command?

Of course it is, this is the reason Firewall exists. But, I wish to introduce you to UFW. https://help.ubuntu.com/community/UFW

Uncomplicated Firewall made my life easier.

Is it possible to block all network traffic except connection from a couple of WAN IPs

With UFW you don't even have to BLOCK them, because the one-time configuration after installing it, is pretty straightforward:

ufw default deny incoming
ufw default allow outgoing

Back to your question, if everything now is BLOCKed from WAN to your Linux PC, to allow someone to access it:

ufw allow from 10.10.10.10 to any port 22

This, allow client 10.10.10.10 to access to the port 22, usually ssh.

Have a look to the link I wrote you above, the commands for UFW simple to remember and easy to use.

To install and start using UFW:

apt-get install ufw
ufw enable
ufw default deny incoming
ufw default allow outgoing

ufw allow from 10.10.10.10 to any port 22

Well, do not write this last rule, 10.10.10.10 is just a random address you would not want to allow.

EDIT: apt-get is for Debian based distros. You did not say what's your

4
  • Mine is Ubuntu 16.04 – Venkata Subbarao Apr 5 '18 at 13:31
  • then UFW is installed already, probably. Mine is. I have many Ubuntu, from version 14 to 16. ;) – aPugLife Apr 5 '18 at 13:32
  • Now a small twist to the question. Assume that I have also whitelisted a LAN IP and someone from WAN hacks a different PC which is on the same LAN where my firewalled PC is present. Assuming that in this case hacker can access my PC by setting IP alias for the attacked PC same as the whitelisted LAN IP. – Venkata Subbarao Apr 5 '18 at 13:49
  • You don't have much knowledge in this field don't you? I'll throw it simple: Hackers can enter wherever they want. It is not a firewall correctly set to limit their capabilities. This said, you can be safe in using UFW. it would be nice if you could install it in the other linux pc/server as well, but in that very unlucky case where someone penetrates your network and have access to your devices, there's quite nothing you can do, only unplugging everything from the power. – aPugLife Apr 5 '18 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.