3

I have two desktops and a laptop running Arch Linux. I have not setup any iptable rules on any of the machines, and I am curious if I should.

One desktop is only used in my home network and is "protected" by a cheap cable modem/router/firewall that is essentially unconfigured and unmaintained (I changed the default password when I got it and haven't looked at it since in 3 years). The desktop runs standard home user applications (e.g., web browsing and Skype) as well as an SSH server. As far as I can tell the firewall default configuration blocks all incoming connections since I can only connect to the SSH server from within my home network.

The other desktop is behind my University's firewall. It is more permissive (I can SSH into the machine from off campus) and hopefully better maintained. Apart from the SSH server the machine doesn't do anything network related other than web browsing and Skype.

The laptop is used behind the home firewall, the University firewall and sometime on unsecured public wireless and wired networks (e.g., hotels and coffee shops).

Is it worth configuring IP tables and if so should the configuration vary across the machines? Potentially related, is it worth setting up a separate independent firewall to protect my home network?

1

Whether or not to use iptables is ultimately up to you. You have to look at what it's capable of and what you want it do to. At a very high level, iptables can do 3 things very well:

  1. Filter inbound network traffic
  2. Filter outbound network traffic
  3. Log traffic

Typically, configuring iptables is unnecessary on systems that are behind a residential router because such a router should block inbound packets by default. If you decide to expose a service to the Internet (ssh for example) and forward a port on your router to an ssh server in your network, then using iptables becomes a little more relevant. It can be used to filter traffic based on source or destination ip/network block, control the icmp errors your system responds to unwanted traffic with or even log every packet sent to anyone, ever.

The question really is:

  • do you have any services on your computers that you don't want other people to interact with?
  • are there any external services you don't want people in your network to be able to connect to?
  • how much logging do you want to do?

Additional info:

CentOS iptables HOWTO

Ulogd

man iptables search for REJECT

1

Actually, you are asking a few different questions. Here are the issues you raised and the points that need to be addressed:

1) Laptops that may attach to other networks, and not just your house or the university, maybe its the coffee shop, grand ma's house or a distant hotel; you really NEED to be running an internal firewall. If it is LINUX/UNIX, then iptables is a good option. You'll need Windows Defender for Microsoft, etc. Otherwise, it doesn't matter what you have at home or at the university, your device is always vulnerable when on networks not fully vetted and secured.

2) The desktops (by definition) aren't hopping from LAN to LAN, they are static. However, since you have introduced into the equation that your internal LAN devices could conceivably be compromised by the mobile devices (e.g. Laptop) which, in turn, may have been exposed while on those external networks, you bring up an excellent argument of why you need to run iptables on your desktops, as well. Kind of a "Trojan Horse", your Laptop, or any mobile device really, can become infected and use your local LAN, behind your firewall, to infect your other devices.

3) Lastly, we often forget about other (non-mobile) devices in our home or university, behind the firewall. The Chinese military got very good at infecting networked PRINTERS, for example. These printers have no internal firewall capabilities and were often reachable because Plug-n-Play networking software would actually drop firewalls on the local router to allow devices to attach via common printer ports like ports 170, 515, 631 and/or 9100, depending on the manufacturer. Nowadays, refrigerators, smoke alarms, TV sets, you name it - they ALL are networked, usually wireless and on your local LAN. So, you are thinking your LAN is protected by a firewall and some anti-virus on a device or two, but security is only as good as your upkeep of the firewall/router rules and not allowing (or at least discovering soon after) unknown/unpredictable changes made by an untold number of Plug-n-Play devices we bring inside the LAN regularly.

These three scenarios really show that you absolutely need to be running iptables. And, knowing this in advance, it would be really 'painful' if a desktop or laptop should get compromised when it otherwise would/could/should have been prevented.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.