search

Chadster766 / McDebian

Linksys WRT3200ACM, WRT1900AC, WRT1900ACS, WRT1200AC and WRT32X Router Debian Implementation
98 stars 14 forks source link

firewall default config #51

Closed popoviciri closed 5 years ago

popoviciri commented 5 years ago

Currently, the default INPUT iptables config is: -A INPUT -i lo -j ACCEPT -A INPUT -i br0 -j ACCEPT -A INPUT -i wan -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i wan -p icmp -j ACCEPT

consider changing to the stateful config: -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -i br0 -j ACCEPT -A INPUT -m conntrack --ctstate INVALID -j DROP -A INPUT -p icmp -j ACCEPT

ref: Simple Stateful Firewall

Chadster766 commented 5 years ago

Aren't both of these configs doing the same thing just with different modules?

popoviciri commented 5 years ago

The missing rule is -A INPUT -m conntrack --ctstate INVALID -j DROP which drops all the "bad flag" combinations by using the connection tracking extension (conntrack) in the kernel. Having using it for the flag check, makes sense to replace state with conntrack as well. Just a suggestion. In the end, whoever goes with McDebian on their router, should know how to configure the firewall. Cheers!

Chadster766 commented 5 years ago

The missing rule is -A INPUT -m conntrack --ctstate INVALID -j DROP which drops all the "bad flag" combinations by using the connection tracking extension (conntrack) in the kernel. Having using it for the flag check, makes sense to replace state with conntrack as well. Just a suggestion. In the end, whoever goes with McDebian on their router, should know how to configure the firewall. Cheers!

Thanks for the suggestion :smile:

AFAIK the below line in McDebian firewall config does the same thing as the conntrack line:

:FORWARD DROP [0:0]
Chadster766 commented 5 years ago

I did some research and it seems that state is aliased to conntrack in the newer iptables anyway :smiley:

https://unix.stackexchange.com/questions/108169/what-is-the-difference-between-m-conntrack-ctstate-and-m-state-state