0

does anyone know how to disable ip forwarding permanently on Ubuntu 18? I don't want any device connected via Ubuntu Hotspot to be able to reach any remote subnet, not even the Internet.

I manually edited /etc/sysctl.conf like this: net.ipv4.ip_forward = 0 and reloaded the NT Manager, so I would get

$sysctl net.ipv4/ip_forward

net.ipv4.ip_forward = 0

After this, I tested the configuration. I created a WiFi Hotspot and I got this:

$sysctl net.ipv4/ip_forward

net.ipv4.ip_forward = 1

and

$cat /proc/sys/net/ipv4/ip_forward

1

which is not what I wanted. So, how could I disable ip forwarding permanently?

iptables isn't working either.

I can do:

 iptables -P FORWARD REJECT
root@lnx:/home# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
//****

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@lnx:/home# 

but I cannot save the configuration. After a reboot, I get this:

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             10.42.0.0/24         state RELATED,ESTABLISHED
ACCEPT     all  --  10.42.0.0/24         anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

I tried to save the configuration:

root@lnx:/home/# !84
apt install dkms
Reading package lists... Done
Building dependency tree       
Reading state information... Done
dkms is already the newest version (2.3-3ubuntu9.4).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

root@lnx:/home/# service iptables-persistent start
Failed to start iptables-persistent.service: Unit iptables-persistent.service not found.
root@lnx:/home/# 

or:

root@lnx:/home/# !218
netfilter-persistent save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-ip4tables save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/25-ip6tables save
root@lnx:/home/# 

and:

iptables-save > /etc/network/iptables.rules
iptables-save > /etc/iptables/rules.v4
iptables-save > /etc/iptables/rules.v6

root@lnx:/home/# cat /etc/network/iptables.rules 
# Generated by iptables-save v1.6.1 on Wed Jul 31 12:45:55 2019
*filter
:INPUT ACCEPT [841:192269]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [246:48142]
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
COMMIT
# Completed on Wed Jul 31 12:45:55 2019
# Generated by iptables-save v1.6.1 on Wed Jul 31 12:45:55 2019
*nat
:PREROUTING ACCEPT [191:20296]
:INPUT ACCEPT [171:19282]
:OUTPUT ACCEPT [1081:87886]
:POSTROUTING ACCEPT [1073:87291]
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
COMMIT
# Completed on Wed Jul 31 12:45:55 2019

root@lnx:/home/# cat /etc/iptables/rules.v4
# Generated by iptables-save v1.6.1 on Wed Jul 31 12:46:02 2019
*filter
:INPUT ACCEPT [849:194382]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [246:48142]
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
COMMIT
# Completed on Wed Jul 31 12:46:02 2019
# Generated by iptables-save v1.6.1 on Wed Jul 31 12:46:02 2019
*nat
:PREROUTING ACCEPT [192:20372]
:INPUT ACCEPT [172:19358]
:OUTPUT ACCEPT [1081:87886]
:POSTROUTING ACCEPT [1073:87291]
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
COMMIT
# Completed on Wed Jul 31 12:46:02 2019

root@lnx:/home/# cat /etc/iptables/rules.v6
# Generated by iptables-save v1.6.1 on Wed Jul 31 12:46:05 2019
*filter
:INPUT ACCEPT [852:195255]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [246:48142]
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan0 -p tcp -m tcp --dport 53 -j ACCEPT
COMMIT
# Completed on Wed Jul 31 12:46:05 2019
# Generated by iptables-save v1.6.1 on Wed Jul 31 12:46:05 2019
*nat
:PREROUTING ACCEPT [192:20372]
:INPUT ACCEPT [172:19358]
:OUTPUT ACCEPT [1081:87886]
:POSTROUTING ACCEPT [1073:87291]
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
COMMIT
# Completed on Wed Jul 31 12:46:05 2019

also:

lug 31 13:01:30 lnx systemd[1]: Starting netfilter persistent configuration...
lug 31 13:01:30 lnx netfilter-persistent[4071]: run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-
lug 31 13:01:30 lnx netfilter-persistent[4071]: run-parts: executing /usr/share/netfilter-persistent/plugins.d/25-
lug 31 13:01:30 lnx systemd[1]: netfilter-persistent.service: Failed with result 'exit-code'.
lug 31 13:01:30 lnx systemd[1]: Failed to start netfilter persistent configuration.

**UPDATE: update: I fixed the netfilter persistent configuration by purging and reinstalling the netfilter-persistent package. But this doesn't change a thing. After a reboot, my iptables got reset

  • 3
    All the configurations for sysctl goes into the /etc/sysctl.d/ folder. Try creating a file there with this setting like /etc/sysctl.d/20-disable-forwarding.conf and add net.ipv4.ip_forward = 1 there. – Michal Przybylowicz Jul 30 '19 at 13:34
  • Hi Michal, thanks answering this. I guess you mean I should add net.ipv4.ip_forward = 0 in /etc/sysctl.d/20-disable-forwarding.conf, which I did, but it doesn't do the trick. After a reboot, I can create a WiFI Hotspot, I still get $sysctl net.ipv4/ip_forward net.ipv4.ip_forward = 1 and $cat /proc/sys/net/ipv4/ip_forward 1 and any device connected to the hotspot can reach remote networks. – Stefano Scoppa Jul 30 '19 at 14:32
  • Are You using a script for this? If so then just add the line to disable forwarding at the end. That should do it. Maybe something during creation of the hotspot triggers the forwarding to be on... – Michal Przybylowicz Jul 30 '19 at 15:30
  • 1
    No, I'm not using any script. I just edited the files I and you mentioned above. – Stefano Scoppa Jul 30 '19 at 15:38
0

It seems the creating HotSpot is re-enabling the IP Forwarding somehow. Don't know is there a way to change this behaviour, but as a workaround you can add iptable rule in FORWARD chain that drops all traffic from clients connected to HotSpot.

  • Yes, it does. root@lnx:/home# grep -r ip_forward /etc/sysctl.conf net.ipv4.ip_forward=0 but, as soon as I turn on the wifi hotspot, I get this: root@lnx:/home/# sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1 – Stefano Scoppa Jul 31 '19 at 10:31
  • It's just rewrites the file /proc/sys/net/ipv4/ip_forward, but doesn't modify /etc/sysctl.conf. And I still think adding firewall rule instead of trying to disallow HotSpot change some system settings is the right way to solve your problem. – Victor Jul 31 '19 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.