Simple ruleset for a home router - Revision history

Hauptmann: Pages using deprecated source tags

2021-12-08T22:53:28Z

Pages using deprecated source tags

← Older revision		Revision as of 22:53, 8 December 2021
Line 3:		Line 3:
	Before you configure your ruleset policy, do not forget to:		Before you configure your ruleset policy, do not forget to:

	<~~source~~ lang="bash">		<syntaxhighlight lang="bash">
	echo 1 > /proc/sys/net/ipv4/ip_forward		echo 1 > /proc/sys/net/ipv4/ip_forward
	</~~source~~>		</syntaxhighlight>

	to enable IPv4 forwarding in your router or enable it through /etc/sysctl.conf for persistency		to enable IPv4 forwarding in your router or enable it through /etc/sysctl.conf for persistency
Line 13:		Line 13:
	This example shows the configuration of an IPv4-only home router using a ppp interface to go out to the Internet.		This example shows the configuration of an IPv4-only home router using a ppp interface to go out to the Internet.

	<~~source~~ lang="bash">		<syntaxhighlight lang="bash">
	flush ruleset		flush ruleset

Line 73:		Line 73:
	}		}
	}		}
	</~~source~~>		</syntaxhighlight>

	= Router with LAN and WLAN segments using VLAN interface to the Internet =		= Router with LAN and WLAN segments using VLAN interface to the Internet =
Line 79:		Line 79:
	A similar example with a Wireless LAN network segment and using a VLAN device to go out to the Internet		A similar example with a Wireless LAN network segment and using a VLAN device to go out to the Internet

	<~~source~~ lang="bash">		<syntaxhighlight lang="bash">
	flush ruleset		flush ruleset

Line 147:		Line 147:
	}		}
	}		}
	</~~source~~>		</syntaxhighlight>

Hauptmann: /* Router with LAN and WLAN segments using VLAN interface to the Internet */ counter is dup

2021-12-08T22:45:43Z

Router with LAN and WLAN segments using VLAN interface to the Internet: counter is dup

← Older revision		Revision as of 22:45, 8 December 2021
Line 144:		Line 144:

	# masquerade private IP addresses		# masquerade private IP addresses
	ip saddr $NET_PRIVATE ~~counter~~ oifname $DEV_WORLD counter masquerade		ip saddr $NET_PRIVATE meta oifname $DEV_WORLD counter masquerade
	}		}
	}		}
	</source>		</source>

Hauptmann: getestet mit Kernel 4.19 und nftables 1.0.0

2021-09-06T21:36:08Z

getestet mit Kernel 4.19 und nftables 1.0.0

← Older revision		Revision as of 21:36, 6 September 2021
Line 1:		Line 1:
			The following example rulesets have been tested with Linux kernel 4.19 and nftables 1.0.0.

	Before you configure your ruleset policy, do not forget to:		Before you configure your ruleset policy, do not forget to:

Hauptmann: /* Router with LAN and WLAN segments using VLAN interface to the Internet */ ein Kommentar

2021-09-06T21:32:34Z

Router with LAN and WLAN segments using VLAN interface to the Internet: ein Kommentar

← Older revision		Revision as of 21:32, 6 September 2021
Line 74:		Line 74:

	= Router with LAN and WLAN segments using VLAN interface to the Internet =		= Router with LAN and WLAN segments using VLAN interface to the Internet =

			A similar example with a Wireless LAN network segment and using a VLAN device to go out to the Internet

	<source lang="bash">		<source lang="bash">
Line 81:		Line 83:
	define DEV_WLAN = wlan0		define DEV_WLAN = wlan0
	define DEV_WORLD = eth0.20		define DEV_WORLD = eth0.20
			# LAN is 192.168.2.0/24 and WLAN is 192.168.3.0/24, hence 192.168.2.0/23 contains both network segments
	define NET_PRIVATE = 192.168.2.0/23		define NET_PRIVATE = 192.168.2.0/23

Line 95:		Line 98:
	}		}

	chain ~~inbound_private~~ {		chain inbound_private_lan {
	# accepting ping (icmp-echo-request) for diagnostic purposes.		# accepting ping (icmp-echo-request) for diagnostic purposes.
	icmp type echo-request limit rate 5/second accept		icmp type echo-request limit rate 5/second accept

	# allow DHCP, DNS and SSH from the private network		# allow DHCP, DNS and SSH from the wired private network
	ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept, udp . 67 : accept}		ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept, udp . 67 : accept}
			}

			chain inbound_private_wlan {
			# accepting ping (icmp-echo-request) for diagnostic purposes.
			icmp type echo-request limit rate 5/second accept

			# allow DHCP and DNS from the private wireless network
			ip protocol . th dport vmap { udp . 53 : accept, tcp . 53 : accept, udp . 67 : accept}
	}		}

Line 110:		Line 121:

	# allow loopback traffic, anything else jump to chain for further evaluation		# allow loopback traffic, anything else jump to chain for further evaluation
	iifname vmap { lo : accept, $DEV_WORLD : jump inbound_world, $DEV_LAN : jump ~~inbound_private~~, $DEV_WLAN : jump ~~inbound_private~~ }		iifname vmap { lo : accept, $DEV_WORLD : jump inbound_world, $DEV_LAN : jump inbound_private_lan, $DEV_WLAN : jump inbound_private_wlan }

	# the rest is dropped by the above policy		# the rest is dropped by the above policy

Hauptmann: add another example with WLAN

2021-09-06T21:26:57Z

add another example with WLAN

@@ Line 1: / Line 1: @@
 This example shows the configuration of an IPv4-only home router using a ppp interface to go out to the Internet.
@@ Line 8: / Line 18: @@
 define NET_PRIVATE = 192.168.0.0/16
-table ip filter {
+table ip global {
      chain inbound_world {
@@ Line 63: / Line 73: @@
 </source>
-Do not forget to:
+= Router with LAN and WLAN segments using VLAN interface to the Internet =
 <source lang="bash">
-echo 1 > /proc/sys/net/ipv4/ip_forward
+flush ruleset
 </source>

Hauptmann: ip_forward sysctl

2021-08-11T06:40:53Z

ip_forward sysctl

← Older revision		Revision as of 06:40, 11 August 2021
Line 62:		Line 62:
	}		}
	</source>		</source>

			Do not forget to:

			<source lang="bash">
			echo 1 > /proc/sys/net/ipv4/ip_forward
			</source>

			to enable IPv4 forwarding in your router or enable it through /etc/sysctl.conf for persistency

Hauptmann: remove IPSec rules

2021-08-11T06:38:18Z

remove IPSec rules

← Older revision		Revision as of 06:38, 11 August 2021
Line 16:		Line 16:
	#		#
	# icmp type echo-request limit rate 5/second accept		# icmp type echo-request limit rate 5/second accept

	~~# allow IPSec~~
	~~udp dport 500 accept~~
	~~ip protocol { esp, ah } accept~~

	# allow SSH connections from some well-known internet host		# allow SSH connections from some well-known internet host

Hauptmann: dhcp

2021-08-11T06:30:22Z

dhcp

← Older revision		Revision as of 06:30, 11 August 2021
Line 29:		Line 29:
	icmp type echo-request limit rate 5/second accept		icmp type echo-request limit rate 5/second accept

	# allow SSH ~~and DNS~~ from the private network		# allow DHCP, DNS and SSH from the private network
	ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept }		ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept, udp . 67 : accept}
	}		}

Hauptmann: missing Klammer

2021-08-11T06:26:27Z

missing Klammer

← Older revision		Revision as of 06:26, 11 August 2021
Line 64:		Line 64:
	ip saddr $NET_PRIVATE oifname $DEV_WORLD masquerade		ip saddr $NET_PRIVATE oifname $DEV_WORLD masquerade
	}		}
			}
	</source>		</source>

Hauptmann: update

2021-08-11T06:25:04Z

update

← Older revision		Revision as of 06:25, 11 August 2021
Line 1:		Line 1:
			This example shows the configuration of an IPv4-only home router using a ppp interface to go out to the Internet.

	<source lang="bash">		<source lang="bash">
	flush ruleset		flush ruleset
Line 13:		Line 15:
	# This sample accepts them within a certain rate limit:		# This sample accepts them within a certain rate limit:
	#		#
	# icmp type echo-request limit rate 5/second ~~burst 5 packets~~ accept		# icmp type echo-request limit rate 5/second accept

	# allow IPSec		# allow IPSec
Line 19:		Line 21:
	ip protocol { esp, ah } accept		ip protocol { esp, ah } accept

	# allow SSH connections ~~from the private network and~~ from some		# allow SSH connections from some well-known internet host
	# well-known internet ~~hosts~~
	ip saddr 81.209.165.42 tcp dport ssh accept		ip saddr 81.209.165.42 tcp dport ssh accept
	}		}

	chain inbound_private {		chain inbound_private {
			# accepting ping (icmp-echo-request) for diagnostic purposes.
			icmp type echo-request limit rate 5/second accept

	# allow SSH and DNS from the private network		# allow SSH and DNS from the private network
	ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept }		ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept }
	}		}

	chain ~~input~~ {		chain inbound {
	type filter hook input priority 0; policy drop;		type filter hook input priority 0; policy drop;