I'm trying to create a test environment for some software I've written and I'm running into issues with creating the right iptable rules. I have a router that the rules are being written too, and I have several devices that are connected to this router (this router is acting as a repeater on my personal network). One of the devices connected to the router is running an ethereum node and a local webserver, the router itself is running a small piece of software that communicates with the webserver and ethereum node.
The software running on the router on startup creates some iptable rules for restricting network connectivity. I'd like to accomplish the following: Have the piece of software write rules on the router that allow the ethereum node to communicate with the broader ethereum network (receive updates on tcp/udp port 30303), allow ssh connections to the router, allow a websocket connection to the ethereum node from the router on port 8546, allow connections on to the webserver on the network. Outside of these connections, I would like to stop other connections unless they've been 'whitelisted' by the web sever. The web application I've written has an interface for allowing you to whitelist connections to domains and ip addresses. E.G. If you were connected to the network you wouldn't be able to browse google.com unless it was whitelisted through the webserver GUI. All whitelist rules are being uniquely appended to the end of the iptable.
Here are the rules that I create on startup, I've been playing with these combinations a lot with various results of websites being inaccessible, but not being able to communicate with ethereum node: These are the rules created when the software starts up:
iptables -P INPUT DROP iptables -P OUTPUT DROP //Loopback iptables INPUT -i -lo -j ACCEPT // DNS lookups iptables OUTPUT -p -udp --dport 53 -j ACCEPT // websocket connection iptables INPUT -s 192.168.8.1 -p tcp --dport 8546 -j ACCEPT iptables OUTPUT -s 192.168.8.1 -p tcp --dport 8546 -j ACCEPT //ssh connection iptables INPUT -p tcp --dport 22 -j ACCEPT // Ethereum node rules iptables INPUT -p tcp --dport 30303 -j ACCEPT iptables INPUT -p udp --dport 30303 -j ACCEPT iptables OUTPUT -p tcp --dport 30303 -j ACCEPT iptables OUTPUT -p udp --dport 30303 -j ACCEPT // Existing connections (confused about implications of this rule) iptables INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Anytime the webserver adds a domain to the whitelist it creates the following rules:
iptables OUTPUT -p tcp -d "whitelisted-domain.com" --dport 80 -j ACCEPT iptables OUTPUT -p tcp -d "whitelisted-domain.com" --dport 443 -j ACCEPT iptables INPUT -p tcp -d "whitelisted-domain.com" --dport 80 -j ACCEPT iptables INPUT -p tcp -d "whitelisted-domain.com" --dport 443 -j ACCEPT
Before I run the software I've been deleting all rules on the router (which breaks browsing, it wont let me access websites on my personal computer):
iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT
On startup the of the software, I'm able to browse the internet freely on my laptop connected to the router and my ethereum node stops receiving updates. The ideal state would be, no web browsing unless domain was whitelisted and continuous updates on ethereum node. I'm unsure where I'm failing here after many different attempts of adding and removing rules.