[Denna]

I'm looking for comments on the firewall rules below that were created with Firewall Builder 5.1.

Topology

Clients connect to the router via Ethernet.

The router connects to a hotspot for Internet access via a media bridge (WAN to Wifi AC1750).

Wireless is disabled on the router.

Legend

dd-wrt is the router.

192.168.1.0/255.255.255.0 are the Ethernet clients.

DNSCrypt_Hosts is a group of IP addresses for DNSCrypt hosts.

NTP_Pool is a group of IP addresses for NTP hosts

Proxy_Hosts is a group of Squid hosts

Questions

1) On this router, "eth0" is the WAN port, correct ?

2) On Rule 1, is the "lo" Interface the correct choice for localhost access on the router ?

3) For Rules 1 - 12, should the router and Ethernet clients specify "Both" for the Direction field ?

4) For Rule 12, should the Service field be set to "ssh" only since HTTP/S is already specified for Rule 6 ?

5) For those who use Firewall Builder, how do you specify the "lo" IP address or MAC address ? The firewall can't be compiled until this is added.

6) For Rules 10 - 11, are the Direction fields correct ?

7) Should any other rules be added ?

8) Should any of the rules be corrected ?

[Per Yngve Berg]

1) `get_wanface` with the quotes will always resolve to the wan interface.

Example: IPTABLES -I FORWARD -i `get_wanface` -J DROP

[Denna]

Per Yngve Berg,

Thanks for the reply.

The firewall rules haven't been uploaded yet.

When I ran that in the Commands tab, the following was returned.

sh: eval: line 1: IPTABLES: not found

[Alozaros]

IPTABLES -I FORWARD -i `get_wanface` -J DROP

i guess it may be cap sensitive
try

iptables -I FORWARD -i `get_wanface` -J DROP

[Denna]

Alozaros,

It was case sensitive.

However, a new error appears.

[Per Yngve Berg]

Lowercase -j

[h8red]

Save firewall, not startup

[Denna]

Per Yngve Berg,

In the Administration\Command field and with Putty, an error wasn't generated but neither was a result.

Was it supposed to return a result ?

[Per Yngve Berg]

No.

The rile will be present in the list.

Iptables -L

[Denna]

Per Yngve Berg,

After running the two commands, below is the output.

Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP 0 -- anywhere anywhere
DROP 0 -- anywhere anywhere
DROP 0 -- anywhere anywhere
DROP 0 -- anywhere anywhere
DROP 0 -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain advgrp_1 (0 references)
target prot opt source destination
Chain advgrp_10 (0 references)
target prot opt source destination
Chain advgrp_2 (0 references)
target prot opt source destination
Chain advgrp_3 (0 references)
target prot opt source destination
Chain advgrp_4 (0 references)
target prot opt source destination
Chain advgrp_5 (0 references)
target prot opt source destination
Chain advgrp_6 (0 references)
target prot opt source destination
Chain advgrp_7 (0 references)
target prot opt source destination
Chain advgrp_8 (0 references)
target prot opt source destination
Chain advgrp_9 (0 references)
target prot opt source destination
Chain grp_1 (0 references)
target prot opt source destination
Chain grp_10 (0 references)
target prot opt source destination
Chain grp_2 (0 references)
target prot opt source destination
Chain grp_3 (0 references)
target prot opt source destination
Chain grp_4 (0 references)
target prot opt source destination
Chain grp_5 (0 references)
target prot opt source destination
Chain grp_6 (0 references)
target prot opt source destination
Chain grp_7 (0 references)
target prot opt source destination
Chain grp_8 (0 references)
target prot opt source destination
Chain grp_9 (0 references)
target prot opt source destination
Chain lan2wan (0 references)
target prot opt source destination
Chain logaccept (0 references)
target prot opt source destination
LOG 0 -- anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `ACCEPT '
ACCEPT 0 -- anywhere anywhere
Chain logbrute (0 references)
target prot opt source destination
0 -- anywhere anywhere recent: SET name: BRUTEFORCE side: source
RETURN 0 -- anywhere anywhere !recent: UPDATE seconds: 60 hit_count: 4 name: BRUTEFORCE side: source
RETURN 0 -- anywhere anywhere limit: avg 1/min burst 1
LOG 0 -- anywhere anywhere LOG level warning tcp-options ip-options prefix `[DROP BRUTEFORCE] : '
DROP 0 -- anywhere anywhere
Chain logdrop (0 references)
target prot opt source destination
LOG 0 -- anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `DROP '
LOG 0 -- anywhere anywhere state INVALID LOG level warning tcp-sequence tcp-options ip-options prefix `DROP '
DROP 0 -- anywhere anywhere
Chain logreject (0 references)
target prot opt source destination
LOG 0 -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `WEBDROP '
REJECT tcp -- anywhere anywhere reject-with tcp-reset
Chain trigger_out (0 references)
target prot opt source destination

I don't see anywhere where ports are noted.