R7800 Firewall Query

Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Goto page Previous  1, 2
View previous topic :: View next topic  
Author Message
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 6870
Location: Romerike, Norway
PostPosted: Wed Apr 17, 2019 16:37    Post subject: Reply with quote
On my R7800, the wan is on eth0, LAN on eth1.

This works on every router:

iptables -t nat -A POSTROUTING -o `get_wanface` -j MASQUERADE
Back to top View user's profile Send private message
Sponsor
htismaqe
DD-WRT User


Joined: 05 Nov 2015
Posts: 471
PostPosted: Wed Apr 17, 2019 16:42    Post subject: Reply with quote
Per Yngve Berg wrote:
On my R7800, the wan is on eth0, LAN on eth1.

This works on every router:

iptables -t nat -A POSTROUTING -o `get_wanface` -j MASQUERADE


Yeah, my R7800 has eth0 as the LAN and eth1 as the WAN.

My question is this:

Does your rule affect all LAN segments? I have created a new bridge group (br1) for guest access. My understanding is that by default br0 is already setup in the default rules and I only had to add a rule to enable NAT for the guest LAN, hence my rule:

Code:
iptables -t nat -A POSTROUTING -s y.y.y.y/24 -o eth1 -j SNAT --to-source $(nvram get wan_ipaddr)


I'm assuming the MASQUERADE operation is essentially hide NAT, which negates the need for SNAT. But don't I still need the -s source operator to specify the rule is for traffic coming from the guest subnet?
_________________
Routing:.......Asus RT-AX88U (Asuswrt-Merlin 384.14)
Switching:....Netgear GS608_V3 & GS605_V4, TrendNet TEG-S82G & TEG-S50G
Back to top View user's profile Send private message
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 6870
Location: Romerike, Norway
PostPosted: Wed Apr 17, 2019 16:45    Post subject: Reply with quote
As long as you don't have any networks behind the router with public IP, you can just NAT everything out the WAN without any need to specify the source interface.
Back to top View user's profile Send private message
htismaqe
DD-WRT User


Joined: 05 Nov 2015
Posts: 471
PostPosted: Wed Apr 17, 2019 16:46    Post subject: Reply with quote
I take that back. eth0 is WAN, eth1 is LAN.

Some of these rules I've been using for years and I can't honestly remember how I arrived at using them other than knowing they still work.

So that rule does contain eth1, which is the LAN interface, and it still works. I just don't remember why I wrote it that way. Obviously, the SNAT is old.
_________________
Routing:.......Asus RT-AX88U (Asuswrt-Merlin 384.14)
Switching:....Netgear GS608_V3 & GS605_V4, TrendNet TEG-S82G & TEG-S50G
Back to top View user's profile Send private message
htismaqe
DD-WRT User


Joined: 05 Nov 2015
Posts: 471
PostPosted: Wed Apr 17, 2019 16:48    Post subject: Reply with quote
Per Yngve Berg wrote:
As long as you don't have any networks behind the router with public IP, you can just NAT everything out the WAN without any need to specify the source interface.


So just replace that rule altogether with the one you gave me?

Replace:

Code:
iptables -t nat -A POSTROUTING -s y.y.y.y/24 -o eth1 -j SNAT --to-source $(nvram get wan_ipaddr)


With:

Code:
iptables -t nat -A POSTROUTING -o `get_wanface` -j MASQUERADE


Also, any ideas on restricting access to management GUI?
_________________
Routing:.......Asus RT-AX88U (Asuswrt-Merlin 384.14)
Switching:....Netgear GS608_V3 & GS605_V4, TrendNet TEG-S82G & TEG-S50G
Back to top View user's profile Send private message
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 6870
Location: Romerike, Norway
PostPosted: Wed Apr 17, 2019 16:53    Post subject: Reply with quote
The GUI is port 80.

iptables -I INPUT -i br1 -p tcp --dport 80 -j REJECT --reject-with tcp-reset
Back to top View user's profile Send private message
htismaqe
DD-WRT User


Joined: 05 Nov 2015
Posts: 471
PostPosted: Wed Apr 17, 2019 17:03    Post subject: Reply with quote
Okay, I think I got it all working now. Many, many thanks to eibgrad and Per Yngve Berg for your help. You guys are the best.

My ports are now all "stealth" according to Shields Up and I have verified I cannot access the router GUI from anywhere but my one workstation.

Here are my firewall rules incorporating all of your suggestions. I finally got multi-port to work, I must have been entering something wrong.

Code:
# Block any remaining traffic from guest LAN after all other rules have been checked
iptables -I INPUT -i br1 -m state --state NEW -j DROP

# Intercept DNS requests to enforce OpenDNS filtering
iptables -t nat -A PREROUTING -i br0 -p udp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
iptables -t nat -A PREROUTING -i br1 -p udp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
iptables -t nat -A PREROUTING -i br1 -p tcp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)

# Restrict access to router management (keeps WAN ports stealth)
iptables -I INPUT -i br0 -p tcp -m multiport --dports 22,23,80,443 -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br0 -s x.x.x.x -p tcp -m multiport --dports 22,23,80,443 -j ACCEPT

# Allow DNS and DHCP from guest LAN
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT

# Allow any traffic from guest LAN not satisfying other rules to be forwarded
iptables -I FORWARD -i br1 -j ACCEPT

# Block traffic from being forwarded between private LAN and guest LAN
iptables -I FORWARD -i br0 -o br1 -j DROP
iptables -I FORWARD -i br1 -o br0 -j DROP

# Enable Internet and NAT for all LAN segments
iptables -t nat -A POSTROUTING -o `get_wanface` -j MASQUERADE

_________________
Routing:.......Asus RT-AX88U (Asuswrt-Merlin 384.14)
Switching:....Netgear GS608_V3 & GS605_V4, TrendNet TEG-S82G & TEG-S50G
Back to top View user's profile Send private message
Mrmad1966
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 37
PostPosted: Fri Apr 19, 2019 10:31    Post subject: Reply with quote
Folks, I was initially happy enough with closed as the status for ports 135,139 and 445 but now like a child in a candy shop I want to see stealth too. I have a simple config on my R7800. One guest WiFi vlan with different DHCP scope to main Lan, and my hardwired devices are also on vlan with different scope using one of the routers Ethernet ports. I only have br0 though.
Can anyone please shed light why the code below does not work ie ports still seen as 'closed'

# Enable Internet and NAT for all LAN segments
iptables -t nat -A POSTROUTING -o `get_wanface` -j MASQUERADE

# Restrict access to router management (keeps WAN ports stealth)
iptables -I INPUT -i br0 -p tcp -m multiport --dports 135,139,445 -j DROP --reject-with tcp-reset
iptables -I INPUT -i br0 -s x.x.x.x -p tcp -m multiport --dports 135,139,445 -j ACCEPT

Initially I was also testing with reject instead of drop but neither seem to work.
Thank you
Back to top View user's profile Send private message
htismaqe
DD-WRT User


Joined: 05 Nov 2015
Posts: 471
PostPosted: Fri Apr 19, 2019 14:47    Post subject: Reply with quote
Hopefully one of the experts can respond because honestly I don't see anything wrong.
_________________
Routing:.......Asus RT-AX88U (Asuswrt-Merlin 384.14)
Switching:....Netgear GS608_V3 & GS605_V4, TrendNet TEG-S82G & TEG-S50G
Back to top View user's profile Send private message
mrjcd
DD-WRT Guru


Joined: 31 Jan 2015
Posts: 6291
Location: Texas
PostPosted: Fri Apr 19, 2019 15:49    Post subject: Reply with quote
Just checked mine and he's all good --- EA8500 r39345M
port 80 da webserver Wink
Back to top View user's profile Send private message
Mrmad1966
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 37
PostPosted: Fri Apr 19, 2019 19:02    Post subject: Reply with quote
Thank you for looking. Added 80 to be rejected and still no joy 😪
Back to top View user's profile Send private message
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 6870
Location: Romerike, Norway
PostPosted: Tue Apr 23, 2019 11:27    Post subject: Reply with quote
Yes it will, but not DNS bacause it's UDP.
Back to top View user's profile Send private message
Mrmad1966
DD-WRT Novice


Joined: 19 Oct 2017
Posts: 37
PostPosted: Thu Apr 25, 2019 12:13    Post subject: Reply with quote
Per Yngve Berg wrote:
Yes it will, but not DNS bacause it's UDP.

Thank you.. for your reply, I have now also added the following line to my firewall but again my ports are still seen as closed. Any thoughts on possible reasons would be really appreciated


iptables -I INPUT -i br0 -p UDP --dports 80 -j REJECT --reject-with tcp-reset

Thank you
Back to top View user's profile Send private message
Goto page Previous  1, 2 Display posts from previous:    Page 2 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum