1

I've been trying to set up rules for a desktop I have in my home network and even though at first this configuration worked, I changed something somewhere and now it won't pass any kind of connection. This script runs with system startup.

#!/bin/bash   

### Variables ###
LAN="eth0"
WLAN="wlan0"
iptables="/sbin/iptables"
ip6tables="/sbin/ip6tables"
ssh_port=50000


### Initial set up ###
clear
# echo -e "\n"


### Flush ###
$iptables -F
$iptables -X
$iptables -Z
echo "Rules flushed; tables are empty now" && echo ""    


### Basic rules ###
$iptables -A INPUT -s 127.0.0.1 -j ACCEPT
$iptables -A OUTPUT -s 127.0.0.1 -j ACCEPT
$iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "Basic rules written"&&echo""


### Special rules ###
# slsk
$iptables -A INPUT -p tcp --dport 63922 -j ACCEPT
$iptables -A INPUT -p tcp --dport 63923 -j ACCEPT
$iptables -A INPUT -p tcp --dport 2416 -j ACCEPT
# mpd
$iptables -A INPUT -p tcp --dport 8800 -j ACCEPT
$iptables -A INPUT -p udp --dport 8800 -j ACCEPT
# allow pings 
$iptables -A INPUT -p icmp -m state --state NEW -j ACCEPT
# ssh server
$iptables -A INPUT -p tcp --dport $ssh_port -j LOG
$iptables -A INPUT -p tcp --dport $ssh_port -j ACCEPT
#$ip6tables -A INPUT -p tcp --dport $ssh_port -j LOG
#$ip6tables -A INPUT -p tcp --dport $ssh_port -j ACCEPT
echo "Special rules set" && echo ""


#### Default policies ###
$iptables -A INPUT -j DROP
$iptables -A OUTPUT -j ACCEPT
$iptables -A FORWARD -j DROP 
echo "Default policies set" && echo ""


echo "Firewall set up finished" && echo ""

Is anything wrong? How can I troubleshoot it?

--- edit --- In response to Alexander Chen

This is an extract of the log after adding the log rule (ub is my computer name):

May 12 18:37:19 ub kernel: [30205.793422] iptables denied: IN=wlan0 OUT= MAC=e8:de:27:07:1f:d6:64:d9:54:c2:d0:ec:08:00 SRC=212.89.0.77 DST=192.168.1.3 LEN=175 TOS=0x00 PREC=0x00 TTL=250 ID=43075 DF PROTO=UDP SPT=53 DPT=27334 LEN=155

### Basic rules ###
[...]
#### Default policies ###
$iptables -A INPUT -j LOG --log-prefix "iptables denied: " --log-level 7
$iptables -A INPUT -j DROP
$iptables -A OUTPUT -j ACCEPT
$iptables -A FORWARD -j DROP 
echo "Default policies set" && echo ""

This is how I have the configuration file right now after trying again with the little UDP fix. Before using the log rule it still wouldn't allow traffic, but after adding it before the drop rule seems to work alright, even though I can't ping anything from command line (and so I guess a lot of stuff is going to give me some headaches). I'm going to keep testing some stuff. Edit* yeah, it doesn't work; at first it doesn't seem to work, then it does and finally it goes off again. Should I post the whole log?

1

The error message in the kernel logging is telling you that an inbound UDP packet to your port 53 was dropped.

Looking at your configuration there is nothing that tells the firewall to accept UDP. (You've got a rule to accept established and related TCP connection packets, but nothing for UDP.)

The solution is to remove the restriction on established and related packets for TCP so that it applies to UDP too:

$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  • I was in a rush and the multiple edits thing got me nervous; didn't check the logs after posting them, should have done otherwise, sorry (if you're not used to the syntax it's slightly hard to understand it entirely but kind of easy to spot some keywords). Right now everything seems alright and this caught me off guard when setting it up at first; I read a bunch of webs with tutorials and information about a home-use iptables and nobody said anything about UDP and it looked weird for me but I went with it. – qkthr May 12 '16 at 20:08
1

It looks like you haven't allowed UDP connections in, thus blocking DNS on UDP port 53.

If you are using DHCP, then you'll also need to allow DHCP on UDP ports 67-68 as well.

Add the following two lines and it should connect:

$iptables -A INPUT -p udp --dport 67:68 -j ACCEPT
$iptables -A INPUT -p udp --dport 53 -j ACCEPT

There may be other ports on udp you might need to open depending on what else is running.

  • It still doesn't work. I forgot to add in the post (posting by mistake got me nervous haha) that I'm talking about just using my web browser (firefox in this case); that and pinging by IP and domain name is what I'm using as a default working config. – qkthr May 12 '16 at 15:40
  • Have you added it before this line: "$iptables -A INPUT -j DROP"? Else add $iptables -A INPUT -j LOG --log-prefix "iptables denied: " --log-level 7 before the drop and see what else gets dropped. The messages normally gets written to syslog. – Alexander Chen May 12 '16 at 15:49
  • Just realized I made a little mistake. Replace 67-68 with 67:68. Will edit answer to match. – Alexander Chen May 12 '16 at 15:57
  • Can you move the "basic rules" section to before the "Default policies"? I am not sure, but I have a suspicion that because you specified to accept inputs from 127.0.0.1 first, connections are being dropped from any other IP addresses. – Alexander Chen May 12 '16 at 16:07
  • I've fixed the udp bit you said there and also added the log rule. I'm editing the post to let you know better how it is structured now and to ad the log message. Sorry for the multiple edits but I'm incredibly clumsy today with my enter key or something. – qkthr May 12 '16 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.