iptables rules

Forums

Add a reply View Replies (4) →

Sruli Saurymper

Offline

Issue

iptables rules

Resolved

0 votes

I checked my iptables rules and I don't understand some of the default rules,



# iptables-save | grep "RELATED,ESTABLISHED"

-A INPUT -p udp -m udp --dport 123 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -i ppp0 -p udp -m udp --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -i ppp0 -p tcp -m tcp --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -i ppp1 -p udp -m udp --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -i ppp1 -p tcp -m tcp --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "Established,Related" -j ACCEPT

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

1. Why the separate "RELATED,ESTABLISHED" rules? why not 1 for each interface to cover all ports?
2. for INPUT there are no "RELATED,ESTABLISHED" rules below port 1024, how does this work?



iptables-save | grep -E " 67| 68"

-A INPUT -i ppp0 -p udp -m udp --sport 67 --dport 68 -j ACCEPT

-A INPUT -i ppp0 -p tcp -m tcp --sport 67 --dport 68 -j ACCEPT

-A INPUT -i ppp1 -p udp -m udp --sport 67 --dport 68 -j ACCEPT

-A INPUT -i ppp1 -p tcp -m tcp --sport 67 --dport 68 -j ACCEPT

-A OUTPUT -o ppp0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT

-A OUTPUT -o ppp0 -p tcp -m tcp --sport 68 --dport 67 -j ACCEPT

-A OUTPUT -o ppp1 -p udp -m udp --sport 68 --dport 67 -j ACCEPT

-A OUTPUT -o ppp1 -p tcp -m tcp --sport 68 --dport 67 -j ACCEPT

Why do we need DHCP port open on the WAN interface?

In Firewall

Monday, July 06 2020, 04:35 PM

Share this post:

Responses (4)

Accepted Answer
Sruli Saurymper

Offline
Tuesday, July 07 2020, 10:33 AM - #Permalink
Resolved

0 votes

got it, thanks
The reply is currently minimized Show
Accepted Answer
Nick Howitt

Offline
Tuesday, July 07 2020, 09:58 AM - #Permalink
Resolved

0 votes

Agreed, but I don't know what PPPoE needs (nothing?). Having said that, I think the rules are also there for Static IP's
The reply is currently minimized Show
Accepted Answer
Sruli Saurymper

Offline
Tuesday, July 07 2020, 09:13 AM - #Permalink
Resolved

0 votes

Thank you very much for that explanation.
I still don't understand why the need for rules at all for 67/68 (DHCP) on the WAN interface.
The reply is currently minimized Show
Accepted Answer
Nick Howitt

Offline
Monday, July 06 2020, 06:47 PM - #Permalink
Resolved

0 votes

You need a rule each for tcp and udp. You cannot do a port rule without a protocol.
In general communication is initiated from a high port (aka unprivileged port), so >=1024. It follows, then, that for security reasons, it is valid to block replies to low ports <1024. The exception to this is ntp when using the ntp program, when communication is from and to port 123, so installing NTP gets this rule. Having said that, chronyd and ntpdate are from high ports and at some point we may switch to using chronyd as it is the upstream default. You could argue that a really basic rule could suffice not specifying ports, protocols or interfaces, but it is unlikely that the firewall will get that sort of review until ClearOS 8.

I can't remember the details but, DHCP is either from 67 to 68 or vice versa, so the related/established rules are covered by the INPUT rules.The outbound request is allowed automatically by OUTPUT rules.

The ClearOS firewall does some odd things where it creates an OUTPUT rule for every INPUT rule it creates. This is generally unnecessary because of the related/established rules, but **may** be necessary for the FORWARD chain if the default policy is to block all and allow by exception. There has been an issue for this for years but as the firewall works, no one has bothered fixing it.
The reply is currently minimized Show