I'm trying to create a test environment for some software I've written and I'm running into issues with creating the right iptable rules. I have a router that the rules are being written too, and I have several devices that are connected to this router (this router is acting as a repeater on my personal network). One of the devices connected to the router is running an ethereum node and a local webserver, the router itself is running a small piece of software that communicates with the webserver and ethereum node.

The software running on the router on startup creates some iptable rules for restricting network connectivity. I'd like to accomplish the following: Have the piece of software write rules on the router that allow the ethereum node to communicate with the broader ethereum network (receive updates on tcp/udp port 30303), allow ssh connections to the router, allow a websocket connection to the ethereum node from the router on port 8546, allow connections on to the webserver on the network. Outside of these connections, I would like to stop other connections unless they've been 'whitelisted' by the web sever. The web application I've written has an interface for allowing you to whitelist connections to domains and ip addresses. E.G. If you were connected to the network you wouldn't be able to browse google.com unless it was whitelisted through the webserver GUI. All whitelist rules are being uniquely appended to the end of the iptable.

Here are the rules that I create on startup, I've been playing with these combinations a lot with various results of websites being inaccessible, but not being able to communicate with ethereum node: These are the rules created when the software starts up:

iptables -P INPUT DROP
iptables -P OUTPUT DROP

iptables INPUT -i -lo -j ACCEPT
// DNS lookups
iptables OUTPUT -p -udp --dport 53 -j ACCEPT
// websocket connection
iptables INPUT -s -p tcp --dport 8546 -j ACCEPT
iptables OUTPUT -s -p tcp --dport 8546 -j ACCEPT
//ssh connection
iptables INPUT -p tcp --dport 22 -j ACCEPT
// Ethereum node rules
iptables INPUT -p tcp --dport 30303 -j ACCEPT
iptables INPUT -p udp --dport 30303 -j ACCEPT
iptables OUTPUT -p tcp --dport 30303 -j ACCEPT
iptables OUTPUT -p udp --dport 30303 -j ACCEPT

// Existing connections (confused about implications of this rule)
iptables INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Anytime the webserver adds a domain to the whitelist it creates the following rules:

iptables OUTPUT -p tcp -d "whitelisted-domain.com" --dport 80 -j ACCEPT
iptables OUTPUT -p tcp -d "whitelisted-domain.com" --dport 443 -j ACCEPT

iptables INPUT -p tcp -d "whitelisted-domain.com" --dport 80 -j ACCEPT
iptables INPUT -p tcp -d "whitelisted-domain.com" --dport 443 -j ACCEPT

Before I run the software I've been deleting all rules on the router (which breaks browsing, it wont let me access websites on my personal computer):

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT

On startup the of the software, I'm able to browse the internet freely on my laptop connected to the router and my ethereum node stops receiving updates. The ideal state would be, no web browsing unless domain was whitelisted and continuous updates on ethereum node. I'm unsure where I'm failing here after many different attempts of adding and removing rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.