Hi all,
I am confusing myself with trying to set up a firewall and hope someone here can help me progress.
I have a small cluster of three Raspberry PI's running NOOBS, which I believe is a Debian fork.
I have a "Gateway" machine, if that is the right phrase, that has a USB Wifi dongle that connects to my Home network router. It also has a NIC � eth0 � connected to a switch that has my other two PI's connected.
I've configured this setup to have dnsmasq running on the gateway PI and the two PI's in my subnet pick up their IP's and DNS from it via DHCP.
Internal subnet is 10.10.0.0/24 and has a subdomain name of pi.home.
My home router provides the USB Wifi interface with its name and IP via DHCP.
Up to this point all was well....
Then I decided to be more ambitious and configure the gateway firewall but I am getting nowhere with it.
I have this simple script to create or clear iptables rules:
#!/bin/sh
# My system IP/set ip address of server
WLAN_IP="192.168.1.88"
ETH0_IP="10.10.0.1"
# Flushing all rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
#CLEAR=true
CLEAR=false
if $CLEAR
then
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
exit
fi
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A OUTPUT -p tcp --sport ssh -j ACCEPT
This allows me to SSH into the Gateway but I can't ssh into my servers on the internal domain.
I appreciate that the above setting will block my DHCP and DNS resolution in the subnet. But at the moment I can't get the simpler task of ssh working.
From the gateway, if I try to ssh to one of the internal servers, I see no traffic at all with tcpdump listening:
tcpdump -i eth0 dst 10.10.0.11 and port 22
If I set the OUTPUT policy to ACCEPT, then I can connect with:
ssh -v pi@10.10.0.11
But like I say, I get nothing with the rule set to DROP.
I'm new to iptables and have the impression that I should be able to set the policy to DROP for everything and then allow specific services.
What am I doing wrong here?
Thanks in advance
Brad
PS
I've dug a little deeper; here is the routing table which looks fine to me:
root@rpifwl:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default rpifwl.pi.home 0.0.0.0 UG 0 0 0 eth0
default BThomehub.home 0.0.0.0 UG 303 0 0 wlan0
10.10.0.0 * 255.255.255.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 202 0 0 eth0
192.168.1.0 * 255.255.255.0 U 303 0 0 wlan0
I now have these rules enabled in iptables:
root@rpifwl:~# iptables -L -n -v
Chain INPUT (policy DROP 8 packets, 1369 bytes)
pkts bytes target prot opt in out source destination
134 9672 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:68
Chain FORWARD (policy ACCEPT 3 packets, 228 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 4 packets, 240 bytes)
pkts bytes target prot opt in out source destination
77 8552 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:53
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:67
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:68
And IP forwarding has been enabled:
root@rpifwl:~# sysctl -w net.ipv4.conf.all.forwarding=1
net.ipv4.conf.all.forwarding = 1
But still can't ssh from the firewall to an internal server unless I set OUTPUT to ACCEPT
Thought I had fixed this but hadn't noticed that my script was still in clear down mode. Grr.
Some additional info:
I set TCP dump to listen on eth0 with no filters and no firewall rules set to DROP. Then ssh'd to target and took a look at the packets. I found that there were calls to three ports that I didn't recognise. Searching online, these seem to be something to do with IANA. So I added rules for these ports, however I still can't SSH past the gateway machine with the firewall rules in place.
# The Internet Assigned Numbers Authority (IANA)
iptables -A INPUT -p tcp --dport 57388 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 57388 -j ACCEPT
iptables -A INPUT -p tcp --dport 46477 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 46477 -j ACCEPT
iptables -A INPUT -p tcp --dport 53022 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 53022 -j ACCEPT
I don't know why I am making calls to these ports when I'm just ssh'ing into a subnet, but there you go.