3

I am trying to set iptables rules in my server to use it as Ubuntu 16.04 based Firewall. I have fair knowledge in Ubuntu. I did some search in Ubuntu help site and in Askubuntu. I came up with the following rules which can be saved in a file and executed as root (sudo sh file):

#!/bin/bash

WAN_IF="enp2s0"
WAN_IP=$(/sbin/ip addr show dev "$WAN_IF" | perl -lne 'if(/inet (\S+)/){print$1;last}');
LAN_IF="enp4s9"
LAN_IP=$(/sbin/ip addr show dev "$LAN_IF" | perl -lne 'if(/inet (\S+)/){print$1;last}');
##### Internal network address (in CIDR notation)
LAN_NET="192.168.17.0/24"

echo
echo "[WAN Interface: $WAN_IF] [WAN IP: $WAN_IP]"
echo "[LAN Interface: $LAN_IF] [LAN IP: $LAN_IP] [Network: $LAN_NET]"
echo
echo -n "Enabling IP Forwarding...\n"

##### Enabling IP Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

echo
echo -n "Loading Firewall Rules...\n"
echo -n "Enabling NAT Rewriting on IN/OUT Packets...\n"

/sbin/iptables-restore <<-EOF;
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

##### INPUT RULES
-A INPUT -i lo -j ACCEPT
-A INPUT -i $LAN_IF -j ACCEPT
-A INPUT -i $WAN_IF -s $LAN_NET -j DROP
-A INPUT -i $WAN_IF -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

##### FORWARD RULES
-A FORWARD -i $LAN_IF -o $WAN_IF -j ACCEPT
-A FORWARD -i $WAN_IF -o $LAN_IF -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

##### OUTPUT RULES
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o $WAN_IF -d $LAN_NET -j DROP
-A OUTPUT -o $LAN_IF -s $LAN_IP -d $LAN_NET -j ACCEPT
-A OUTPUT -o $WAN_IF -s $WAN_IP -j ACCEPT

##### All Other Requests are DROPPED
-A OUTPUT -j DROP
-A INPUT -j DROP
COMMIT


##### NAT Rewriting on IN/OUT Packets
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o $WAN_IF -j MASQUERADE
COMMIT
EOF


echo -n "Bloacking IP6...\n"
/sbin/ip6tables-restore <<-EOF;
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
COMMIT
EOF

echo
echo "Done!"
echo

My questions are:

I have the following network topology:

Internet >>>>> [ WAN <<<>>> SERVER <<<>>> LAN ] <<<<< Local Users

  1. On my server, I want to block all incoming traffic on WAN (including pings and other discovery and/or hacking requests), but allow internet traffic to go through for the SERVER and for the Local users on LAN. Is the above code OK with such rules?

  2. I have some services on my SERVER (like MYSQL and SSH) which I manage directly from the SERVER itself, I want to block local users on LAN and Internet on WAN from accessing or connecting to services and everything on my SERVER. Is the above code OK with such rule?

  3. Is there any notes or security flaws that may be cased by the above rules?

  4. Is it safe to open SSH port to the Internet on WAN if I use the following rule? (Note: I will be using ssh public key authentication only, no clear text passwords.)

    -A INPUT -i $WAN_IF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -d $WAN_IP --dport 22 -j ACCEPT
    

Thanks a lot guys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.