[SOLVED]iptables, block all traffic but allow VPN and NTP

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Author Message
rotation
DD-WRT User


Joined: 13 Dec 2012
Posts: 54

PostPosted: Mon Sep 19, 2022 15:42    Post subject: [SOLVED]iptables, block all traffic but allow VPN and NTP Reply with quote
Hello all,

unfortunately I am stuck with iptables Sad
I would like to block all traffic from and to a specific IP in my network, but allow the traffic via VPN as well as allow NTP.

The device is a IP Camera. Block all traffic but allow watching the video Stream via VPN and allow NTP.

Unfortunately I constantly get a fail when trying to sync the time in the camera.

Code:

iptables -t nat -I POSTROUTING -s 192.168.66.0/24 -o ppp0 -j MASQUERADE
iptables -I FORWARD -s 192.168.1.15 -o ppp0 -j REJECT
iptables -A INPUT -p ALL -s at.pool.ntp.org -j ACCEPT
iptables -A INPUT -p ALL -d at.pool.ntp.org -j ACCEPT
iptables -A OUTPUT  -p ALL -s at.pool.ntp.org -j ACCEPT
iptables -A OUTPUT  -p ALL -d at.pool.ntp.org -j ACCEPT


The first is VPN, the second is the camera, but I constantly get a fail when trying the time sync. I also tried with -p udp --dport 123 (and dport) but no success Sad
Sponsor
dale_gribble39
DD-WRT Guru


Joined: 11 Jun 2022
Posts: 1889

PostPosted: Mon Sep 19, 2022 16:28    Post subject: Reply with quote
Policy Based Routing; possibly IPSET.

OpenVPN guides and documentation

WireGuard guides and documentation

IPSET

_________________
"The woods are lovely, dark and deep,
But I have promises to keep,
And miles to go before I sleep,
And miles to go before I sleep." - Robert Frost

"I am one of the noticeable ones - notice me" - Dale Frances McKenzie Bozzio

<fact>code knows no gender</fact>

This is me, knowing I've ruffled your feathers, and not giving a ****
Some people are still hard-headed.

--------------------------------------
Mac Pro (Mid 2012) - Two 2.4GHz 6-Core Intel Xeon E5645 processors 64GB 1333MHz DDR3 ECC SDRAM OpenSUSE Leap 15.5
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12812
Location: Netherlands

PostPosted: Mon Sep 19, 2022 17:35    Post subject: Reply with quote
Unfortunately you do not state router model and build number, with VPN you probably mean VPN server.

The VPN server has a GUI setting to NAT traffic from its own subnet no need to do it manually.

Try the following to block traffic from your camera:
iptables -I FORWARD -s 192.168.1.15 -m state --state NEW -j REJECT

Note:
I did not specify an out interface so that it blocks both outgoing via WAN and VPN if the camera never uses the VPN you can specify an out interface e.g.: -o $(get_wanface)
As you do want to connect to your camera from the VPN or from inside I did specify state NEW

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
rotation
DD-WRT User


Joined: 13 Dec 2012
Posts: 54

PostPosted: Mon Sep 19, 2022 17:45    Post subject: Reply with quote
Thank you,
Netgear R6400 V2
Firmware: DD-WRT v3.0-r41174 std (09/26/19)

What does this do?
Quote:
-m state --state NEW


I already had this in my iptables but deleted it because I saw no difference.

However: I still struggle with blocking all traffic to the specific IP adresses but allow NTP. Blocking traffic works, but allowing NTP to pass does not. I constantly get an error from the camera interface telling me the NTP time sync was not possible. If I delete the blocking of the camera IP adress it works obviously Sad
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12812
Location: Netherlands

PostPosted: Mon Sep 19, 2022 18:00    Post subject: Reply with quote
Your build is old and outdated and has security issues.

Upgrading to a recent build e.g. 50176 is highly recommended.

Coming from such an old build a reset to defaults *after* upgrade is also highly recommended.
Put settings in manually, never restore from a backup (to a different build)

If your camera wants to connect to an NTP server, you can allow that port to go out:
iptables -I FORWARD -s 192.168.1.15 -p udp --dport 123 -j ACCEPT

This rule has to come after the first rule I send.

-m state --state NEW is necessary to connect to your camera's from the VPN as I did not specify an out interface

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
rotation
DD-WRT User


Joined: 13 Dec 2012
Posts: 54

PostPosted: Mon Sep 19, 2022 18:11    Post subject: Reply with quote
Thank you, that appears to work. Smile
I am aware of the old version though
the-joker
DD-WRT Developer/Maintainer


Joined: 31 Jul 2021
Posts: 2146
Location: All over YOUR webs

PostPosted: Mon Sep 19, 2022 18:54    Post subject: Reply with quote
Are you also aware of the myriad of known and some currently exploited unpatched CVE's that version is vulnerable to?
_________________
Saving your retinas from the burn!🔥
DD-WRT Inspired themes for routers
DD-WRT Inspired themes for the phpBB Forum
DD-WRT Inspired themes for the SVN Trac & FTP site
Join in for a chat @ #style_it_themes_public:matrix.org or #style_it_themes:discord

DD-WRT UI Themes Bug Reporting and Discussion thread

Router: ANus RT-AC68U E1 (recognized as C1)
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum