1

I am trying to get my VLANs and iptables to function correctly.

enp2s0f0 = WAN

enp2s0f1.4 = Admin Network

What I am trying to attempt, is allow the Admin Network to connected to any device connected to the VLANs and the other VLANs are able to connect within their VLAN only.

Below is my current iptables:

# Generated by iptables-save v1.6.0 on Wed Jun 19 11:00:52 2019
*filter
:INPUT ACCEPT [145:12267]
:FORWARD ACCEPT [570:105932]
:OUTPUT ACCEPT [730:148524]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i enp2s0f0 -p tcp -m conntrack --ctstate NEW -m tcp -m multiport --dports 20,21,22,80,443,139,445,8181,4343,8883,60000:65535 -j ACCEPT
-A INPUT -i enp2s0f0 -p udp -m conntrack --ctstate NEW -m udp -m multiport --dports 123,137,138,5353,5678,1194 -j ACCEPT
-A INPUT -i enp2s0f0 -j DROP
-A FORWARD -i enp2s0f1.2 -o enp2s0f1.3 -j DROP
-A FORWARD -i enp2s0f1.2 -o enp2s0f1.4 -j DROP
-A FORWARD -i enp2s0f1.3 -o enp2s0f1.2 -j DROP
-A FORWARD -i enp2s0f1.3 -o enp2s0f1.4 -j DROP
COMMIT
# Completed on Wed Jun 19 11:00:52 2019
# Generated by iptables-save v1.6.0 on Wed Jun 19 11:00:52 2019
*raw
:PREROUTING ACCEPT [1367:271510]
:OUTPUT ACCEPT [736:149313]
-A PREROUTING -p tcp -m tcp --dport 21 -j CT --helper ftp
COMMIT

# Completed on Wed Jun 19 11:00:52 2019
# Generated by iptables-save v1.6.0 on Wed Jun 19 11:00:52 2019
*nat
:PREROUTING ACCEPT [56:3871]
:INPUT ACCEPT [40:2935]
:OUTPUT ACCEPT [45:14318]
:POSTROUTING ACCEPT [52:14303]
-A POSTROUTING -o enp2s0f0 -j MASQUERADE
COMMIT
# Completed on Wed Jun 19 11:00:52 2019

Below is my network interfaces

# Include additional interface stanzas.
source-directory interfaces.d

# The loopback network interface
auto lo
iface lo inet loopback
pre-up iptables-restore < /etc/iptables.rules

# enp2s0f0 network interface
allow-hotplug enp2s0f0
iface enp2s0f0 inet dhcp

# server connections
# enp2s0f1 network interface
allow-hotplug enp2s0f1
iface enp2s0f1 inet static
    address 10.0.0.1
    netmask 255.255.255.0
    network 10.0.0.0
    broadcoast 10.0.0.255
    up vconfig add enp2s0f1 2
    up vconfig add enp2s0f1 3
    up vconfig add enp2s0f1 4

# guest network
# enp2s0f1.2 network interface
auto enp2s0f1.2
iface enp2s0f1.2 inet static
    address 10.0.10.1
    netmask 255.255.255.0
    network 10.0.10.0
    broadcast 10.0.10.255

# home network
# enp2s0f1.3 network interface
auto  enp2s0f1.3
iface enp2s0f1.3 inet static
    address 10.0.20.1
    netmask 255.255.255.0
    network 10.0.20.0
    broadcast 10.0.20.255

# business network
# enp2s0f1.4 network interface
auto enp2s0f1.4
iface enp2s0f1.4 inet static
    address 10.0.30.1
    netmask 255.255.255.0
    network 10.0.30.0
    broadcast 10.0.30.255

I also run a DNS server that is connected to enp2s0f1 via a managed switch. I have dnsmasq set the DNS Server ip automatically via dhcp settings. All vlans will need to be able to communicate with whatever is connected to the switch.

I tried iptables -P FORWARD DROP but that drop all access to anything connected to the switch.

  • Is the debian host also gateway to the internet for devices in the vlans? – Anton Danilov Jun 23 at 17:59
0
  1. You don't need up vconfig... statements in the enp2s0f1 section of the interfaces file. Vlan interfaces will be created at bring up corresponded interfaces automatically.

  2. For better control use ACCEPT/DROP all instead DROP/ACCEPT all.

  3. In your case the rules will be look like:

# allow replies and port forwarding
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED,DNAT -j ACCEPT

# allow access to WAN and to DNS from all interfaces (if your debian host is gateway)
iptables -A FORWARD -i enp2s0f1+ -o enp4s0f0 -j ACCEPT
iptables -A FORWARD -i enp2s0f1+ -o enp4s0f1 -j ACCEPT

# allow access to admin vlan from all vlans
iptables -A FORWARD -o enp2s0f1.4 -j ACCEPT
iptables -A FORWARD -i enp2s0f1.4 -j ACCEPT

# log and drop other connections
iptables -A FORWARD -m conntrack --ctstate NEW,INVALID,UNTRACKED -j NFLOG
# you can just set FORWARD policy to DROP
iptables -A FORWARD -j DROP
  1. To troubleshoot check rule counters and use the tcpdump.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.