1

I have used the following commands, taken from here:

# Allow loopback device (internal communication)
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

# Allow all local traffic.
sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A OUTPUT -d 192.168.1.0/24 -j ACCEPT

# Set default policies to drop all communication unless specifically allowed
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT DROP
sudo iptables -P FORWARD DROP

This appears to successfully block internet traffic from almost all sources, but somehow Google services accessed through Chromium (on Raspbian Buster on a Pi 4 Model B) are allowed through (for example, youtube.com loads unimpeded). Searching didn't really help me understand the issue; the closest result I found was this question, but the answer, so far as I understand it, says the rule filters specifying domain can't be applied to the packets successfully, whereas the rules I've used don't specify a domain at all. They should be dropping all packets except local and loopback, regardless of domain or browser, right?

For background, this is on a NAS that I'm paranoid about being exposed to the internet. I have similar rules on a Pi which does have internet access through OpenVPN, and when the VPN connection is down, similar behavior is observed: No traffic is allowed except, curiously, Google services accessed through Chromium. The main question is about the NAS to eliminate the VPN as a concern.

Edit: Added per requests in comments, the output of sudo iptables-save while YouTube is loaded in the browser and the rules are in effect:

# Generated by xtables-save v1.8.2 on Mon Apr 27 13:24:52 2020
*filter
:INPUT DROP [7:2304]
:FORWARD DROP [0:0]
:OUTPUT DROP [482:36138]
-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.1.0/24 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
COMMIT
# Completed on Mon Apr 27 13:24:52 2020

I do not believe there is a proxy, though I'm unfamiliar with the exact definition of that term in networking. Google indicates to me that it is relevant that I connect my router to my ISP from a modem, not an intermediary server?

Also, in response to a deleted comment, my ISP appears to be IPv6-capable.

Edit 2: Output of ping -c6 2001:67c:2564:a119::77:

PING 2001:67c:2564:a119::77(2001:67c:2564:a119::77) 56 data bytes
64 bytes from 2001:67c:2564:a119::77: icmp_seq=1 ttl=49 time=132 ms
64 bytes from 2001:67c:2564:a119::77: icmp_seq=2 ttl=49 time=130 ms
64 bytes from 2001:67c:2564:a119::77: icmp_seq=3 ttl=49 time=127 ms
64 bytes from 2001:67c:2564:a119::77: icmp_seq=4 ttl=49 time=147 ms
64 bytes from 2001:67c:2564:a119::77: icmp_seq=5 ttl=49 time=129 ms
64 bytes from 2001:67c:2564:a119::77: icmp_seq=6 ttl=49 time=128 ms

--- 2001:67c:2564:a119::77 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 12ms
rtt min/avg/max/mdev = 126.981/132.157/147.250/6.932 ms

Edit 3: Final edit for now. Just wanted to append the working rules I got following the advice in the solution:

# Allow loopback device (internal communication)
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT
sudo ip6tables -A INPUT -i lo -j ACCEPT
sudo ip6tables -A OUTPUT -o lo -j ACCEPT

# Allow all local traffic.
sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A OUTPUT -d 192.168.1.0/24 -j ACCEPT

# Allow VPN establishment
# Only 2 ports open, 1 for DNS and 1 for VPN
# If establishing through an IP and not a name, the ones with port 53 can be removed
# Port 1198 may be different depending on the VPN
sudo iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
sudo iptables -A INPUT -p udp --sport 53 -j ACCEPT
sudo iptables -A OUTPUT -p udp --dport 1198 -j ACCEPT
sudo iptables -A INPUT -p udp --sport 1198 -j ACCEPT

# Accept all TUN connections (tun = VPN tunnel)
sudo iptables -A OUTPUT -o tun+ -j ACCEPT
sudo iptables -A INPUT -i tun+ -j ACCEPT

# Set default policies to drop all communication unless specifically allowed
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT DROP
sudo iptables -P FORWARD DROP
sudo ip6tables -P INPUT DROP
sudo ip6tables -P OUTPUT DROP
sudo ip6tables -P FORWARD DROP

Note that there is no local traffic rule for ip6tables in here, but it may be needed if your local network is running IPv6 instead of IPv4. In that case, change iptables to ip6tables and replace the IP address in the local traffic rules and you're good to go.

6
  • 1
    Is it making a network request or is it loading from cache?
    – jordanm
    Apr 27, 2020 at 17:10
  • Definitely making network requests; it can load content created after the rules were put in place, and I also cleared all browsing data to test with the same results.
    – Snackhole
    Apr 27, 2020 at 17:13
  • 1
    Can you pls. append the output of sudo iptables-save while the iptable rules are in place and Chromium connects to youtube. Also, is there a proxy in your network?
    – bey0nd
    Apr 27, 2020 at 18:07
  • See edit for response to both.
    – Snackhole
    Apr 27, 2020 at 18:44
  • Just a quick test for IPv6. Can you pls. append the output of ping6 2001:67c:2564:a119::77 (or ping -6 if ping6 doesn't work).
    – bey0nd
    Apr 27, 2020 at 19:24

1 Answer 1

2

As the result of the ping shows is your computer capable of utilizing IPv6 to communicate to the outside world. Therefore Chromium will use IPv6 when it can't get a IPv4 connection. If you want to prevent that, you'll have to research creating firewall rules with ip6tables.

1
  • Interesting; for some reason I thought iptables took care of IPv6 as well, perhaps because iptables-persistent mentions it? I will investigate this and mark the answer correct if it is resolved.
    – Snackhole
    Apr 27, 2020 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .