Block everything from outside (except maybe VPN when I travel)?

[Bamsefar]

So I have this script that blocks certain countries, and another script that keeps a watch on port scans and such things and blocks IPs that "behave bad".

However what I realize is that I actually don't need access from external WWW to my router - normally I only allow (a few protocols) traffic from the inside to outside. I do not have a web server or anything like that.

So from a simple point of view:

1. Block anything from external WWW that tries to connect or something onto my router
2. Maybe, when I travel, allow my mobile phone (MAC adress I guess) would be allowed to connect over VPN to my router from the country I KNOW (like US) - but this is optional (I rather have all closed down than expose my router if that is what it takes)

Any ideas how to do this?

 

[martinr]

Isn't your router firewall already automatically doing what you want in (1) and (2)?

 

[DrPozo]

Any ideas how to do this?

I've been thinking about it too.

1. Allow all Internet host traffic for established connections.
2. Block all Internet hosts who try to connect, when they're coming from the outside.
3. Use TOR hidden service to access your home router, when you're coming from the outside.

That's all we know.

 

[schmerg]

I've been thinking about it too.

1. Allow all Internet host traffic for established connections.
2. Block all Internet hosts who try to connect, when they're coming from the outside.
3. Use TOR hidden service to access your home router.

That's all we know.

Or use something like the port knocking infrastructure/techniques to only open the SSH socket (ie other connections are refused before even authenticating) for hosts that signal to do so in some specific way.

That way the router blocks all the ports ("stealth closed" as normal) including SSH except for hosts that know how to open it... probably more secure than MAC address, if a little more hassle, but looking into knockd may contain some handy hints on how to do this even without implementing knocking.

Of course, the problem is that people then reply on knocking or similar obscuring techniques (such as my running SSH on 443) to protect weak passwords ... but I'm sure the OP is smarter than do that.

--
Tim

 

[Bamsefar]

Here is my INPUT chain, which I think one could minimize somewhat - why go over countries and stuff since well no one are allowed anyway:

admin@RT-AC88U:/tmp/home/root# iptables -L
Chain INPUT (policy ACCEPT)
target  prot opt source  destination
DROP  all  --  anywhere  anywhere  match-set TorNodes src
ACCEPT  all  --  anywhere  anywhere  match-set Whitelist src
DROP  all  --  anywhere  anywhere  match-set BlockedCountries src
DROP  all  --  anywhere  anywhere  match-set Blacklist src
DROP  all  --  anywhere  anywhere  match-set TorNodes src
ACCEPT  all  --  anywhere  anywhere
ACCEPT  udp  --  anywhere  anywhere  udp dpt:1194
logdrop  icmp --  anywhere  anywhere  icmp echo-request
logdrop  all  --  anywhere  anywhere  state INVALID
ACCEPT  all  --  anywhere  anywhere  state RELATED,ESTABLISHED
ACCEPT  all  --  anywhere  anywhere  state NEW
ACCEPT  all  --  anywhere  anywhere  state NEW
ACCEPT  udp  --  anywhere  anywhere  udp spt:bootps dpt:bootpc
ACCEPT  icmp --  anywhere  anywhere  icmp !echo-request
logdrop  all  --  anywhere  anywhere

 

[RMerlin]

Here is my INPUT chain, which I think one could minimize somewhat - why go over countries and stuff since well no one are allowed anyway:

Personally, I would put the DROPs after this, for performance reasons:

ACCEPT  all  --  anywhere  anywhere  state RELATED,ESTABLISHED

That way, you will only check if a packet should be dropped when it first tries to connect to you, not on every single packet that goes in.

 

[Bamsefar]

Thnaks RMerlin! I'll change it

However, I still wonder if one could do just something like:

ACCEPT  all  --  anywhere  anywhere  state RELATED,ESTABLISHED
DROP all -- anywhere anywhere

or with VPN allowed (and now I am only guessing, so I most likly very wrong now):

ACCEPT  all  --  anywhere  anywhere  state RELATED,ESTABLISHED
ACCEPT  all  --  anywhere  anywhere
ACCEPT  udp  --  anywhere  anywhere  udp dpt:1194
DROP all -- anywhere anywhere

Even though I wonder what the line with "ACCEPT all -- anywhere anywhere" realy does - is it needed (this line and the udp dpt:1194 are added when I turn on VPN, and removed when I tunr VPN off)?

I am trying, from time to time, to understand how this all works. Sometimes I make progress (I learn something maybe), but then again - like this with the VPN row above - I seem to get lost....

 

[Bamsefar]

Let me add a few more lines:

admin@RT-AC88U:/tmp/home/root# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target  prot opt in  out  source  destination
  0  0 ACCEPT  all  --  tun21  *  0.0.0.0/0  0.0.0.0/0
  0  0 ACCEPT  udp  --  *  *  0.0.0.0/0  0.0.0.0/0  udp dpt:1194
  0  0 DROP  all  --  *  *  0.0.0.0/0  0.0.0.0/0  match-set TorNodes src
 963K  73M ACCEPT  all  --  *  *  0.0.0.0/0  0.0.0.0/0  match-set Whitelist src
 7240  337K DROP  all  --  *  *  0.0.0.0/0  0.0.0.0/0  match-set BlockedCountries src
 293K  18M DROP  all  --  *  *  0.0.0.0/0  0.0.0.0/0  match-set Blacklist src
  0  0 DROP  all  --  *  *  0.0.0.0/0  0.0.0.0/0  match-set TorNodes src
  3  196 logdrop  icmp --  eth0  *  0.0.0.0/0  0.0.0.0/0  icmptype 8
 2779  117K logdrop  all  --  *  *  0.0.0.0/0  0.0.0.0/0  state INVALID
 745K  205M ACCEPT  all  --  *  *  0.0.0.0/0  0.0.0.0/0  state RELATED,ESTABLISHED
 475K  81M ACCEPT  all  --  lo  *  0.0.0.0/0  0.0.0.0/0  state NEW
 9520  436K ACCEPT  all  --  br0  *  0.0.0.0/0  0.0.0.0/0  state NEW
  0  0 ACCEPT  udp  --  *  *  0.0.0.0/0  0.0.0.0/0  udp spt:67 dpt:68
  0  0 ACCEPT  icmp --  *  *  0.0.0.0/0  0.0.0.0/0  icmp !type 8
 1451 87105 logdrop  all  --  *  *  0.0.0.0/0  0.0.0.0/0

 

[RMerlin]

owever, I still wonder if one could do just something like:

Adding your own rule for established and related conntrack states might indeed be simpler than trying to insert your other rules in the middle of the chain.

Even though I wonder what the line with "ACCEPT all -- anywhere anywhere" realy does - is it needed (this line and the udp dpt:1194 are added when I turn on VPN, and removed when I tunr VPN off)?

That output is non verbose, you are missing the interface context in that "ACCEPT all all" rule.

The OpenVPN rule gets added/removed whenever you stop or start the OpenVPN server.

 

[Bamsefar]

ACCEPT  all  --  anywhere  anywhere  state RELATED,ESTABLISHED
DROP all -- anywhere anywhere

or with VPN allowed (and now I am only guessing, so I most likly very wrong now):

ACCEPT  all  --  anywhere  anywhere  state RELATED,ESTABLISHED
ACCEPT  all  --  anywhere  anywhere
ACCEPT  udp  --  anywhere  anywhere  udp dpt:1194
DROP all -- anywhere anywhere

The first might work, but the 2nd will open up for connection from anyware? And well VPN for my mobile in one country yes that is nice. But I would like to DROP all countrys not allowed. Is this doable?