0

I have this example on IPtables

Iptable is on the Host. This host has 2 ethernets connected eth0(192.168.0.2) where the LAN is connected and eth1(151.100.4.3) where it is connection to the internet.

If the host 192.168.0.25 is under attack I want to define a rule to isolate it as much as possible.

I think about this IPtables and give this answer :

Iptables OUTPUT - d 192.168.0.25 -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j DROP
Iptables INPUT  -s 192.168.0.25 -i eth0 -m state --state NEW,ESTABLISHED,RELATED -j DROP
Iptables FORWARD - d 192.168.0.25 -o eth0 i- eht1 -m state --state NEW,ESTABLISHED,RELATED -j DROP
Iptables FORWARD  -s 192.168.0.25 -i eth0 o- eht1 -m state --state NEW,ESTABLISHED,RELATED -j DROP

Is correct block the forward chain too? I m thinking to block the FORWARD because maybe traffic can be or come from the internet part.

In case I create a new firewall on the attacker host (192.168.0.25) Can I just create these two rules more generics

Iptables OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j DROP
Iptables INPUT -m state --state NEW,ESTABLISHED,RELATED -j DROP

So, in this case, the host can do nothing

Is correct my hypothesis?

Improve this question
3
  • Please proof-read, and fix your grammar. It is hard to know what you are saying.
    – ctrl-alt-delor
    Feb 9, 2020 at 13:45
  • @ctrl please make allowances for non-native English.
    – Chris Davies
    Feb 9, 2020 at 13:57
  • @roaima. I agree, so they may have to proof-read twice. (I can't make allowance of understanding what I don't understand). If not native English writer, then avoid contractions.
    – ctrl-alt-delor
    Feb 9, 2020 at 14:35

1 Answer 1

Reset to default
0

"Attack" could mean different things, by the way let's say that if you want to block external access to host in your LAN, then forward chain is enough.

Naturally if host gets compromised you can't do anything with a firewall to block possibile in-LAN activity since it would be P2P at that point.

Better not to expose public IP here.

Improve this answer
4
  • it's an example on my professor slide, I think the IP is just for example. For "attack" I think to mean isolation from external. For you is enough to use just INPUT/OUTPUT?
    – theantomc
    Feb 9, 2020 at 12:24
  • Ok, probably Rome based professor ;) By the way INPUT chain is used to manage traffic directed to the firewall itself, while FORWARD chain is used to manage traffic directed to other hosts, so DROP traffic on FORWARD chain for that host.
    – realpclaudio
    Feb 9, 2020 at 12:28
  • Yep, you got it :) I usually see these exercises with two rules with INPUT/OUTPUT for drop the traffic. So in this case first all I think about these two rules. I added the other two rules on FORWARD because I thought that the "internet" can communicate with local host with FORWARD chain. So in my case, I have the first two rules for the LAN e last two for the Internet.
    – theantomc
    Feb 9, 2020 at 12:34
  • 1
    As i repeat, FORWARD chain is enough to block accesses from/to internet to host. INPUT is just denying connections from host to firewall. No firewall could block host from doing traffic with the rest of the LAN.
    – realpclaudio
    Feb 9, 2020 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .