Blocking a device from all network traffic, but with specific exceptions

Question

I have a router that runs Tomato, so I have access to iptables. There's a device on my network with an IP address of 192.168.1.100. I don't want it to send data to the Internet except for a very specific case.

Specifically, I don't want it to send outgoing data to the Internet at all except for secure SMTP (TCP port 587 or 465) and even then, just to one SMTP server. Incoming traffic is a concern too, but blocking outbound is more important. It should continue to allow LAN traffic, so packets with an origin and destination of 192.168.1.0/24 are fine.

I don't know much about iptables so I'm not sure how to go about doing this, or if iptables is even the best approach. I've set up rules before that drop packets, but I've never set one up that blocks everything but packets that meet specific requirements.

How would you suggest I go about doing this?

Answer 1

If you don't have a rule to permit ESTABLISHED,RELATED traffic the traffic may not get through at all.

iptables -I INPUT 1 -m conntrack -j ACCEPT  --ctstate RELATED,ESTABLISHED
iptables -A OUTPUT -m tcp -p tcp -m multiport --dports 587,465 -d <ipaddress of smtp> -j ACCEPT
iptables -A OUTPUT -s 192.168.1.100 -j DROP
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.1.0/24 -m tcp -p tcp -m multiport --dports 587,465 -j ACCEPT 
iptables -A FORWARD -s 192.168.1.100 !-d 192.168.1.0/24,<ipaddress of smtp> -j DROP

permit,permit, and then deny all other traffic.

However, without knowing what other rules you have, I can't tell you where to put them.

The order the rules are in is critical

The rules are processed in order, and if you add my rules to the end of an existing set of rules they may not work right.

Answer 2

All you need is to drop outbound traffic from your host with rules like that:

iptables -A FORWARD -s 192.168.1.100 -p tcp --dports 80 -j ACCEPT 
iptables -A FORWARD -s 192.168.1.100 -j DROP

The first rule will allow your device to use HTTP protocol for any host, and the second one will ban any other traffic outside of your home network.

If you need to allow all the traffic to spectacular host you'll need to use something like that instead:

iptables -A FORWARD -s 192.168.1.100 -d 8.8.8.8 -j ACCEPT 
iptables -A FORWARD -s 192.168.1.100 -j DROP

Your device will be able to connect to the IP 8.8.8.8 with any protocol, but will be denied for all others.

You can look for more examples here.