Ubuntu 9.04, Firestarter complaints even behind the NAT router

Question

I'm behind a router. In router config, I blocked:

• all (inbound and outbound) UDP
• inbound ICMP

Local iptables are configures with Firestarter wizard:

• block all incoming connections
• allow all outgoing connections
• filter ICMP except ping
• block broadcast from external netword

Now, Firestarter still complaints about blocked TCP and ICMP connections to my internal IP (192.168.0.*), on different ports. There are no UDP complaints, but only because router blocks them all. Formerly, with inbound (but not outbound) UDP-s blocked I was also getting tons of blocked UDP connections (especially with Skype launched).

I don't get how it is possible that Firestarter complaints about blocked TCP connections. My understanding is that behind the router I'm not reachable from the outside world (due to NAT translation), and router passes only those inbound packets that match outbound packets. Now, iptables should work in the same way - it should accept inbound response packets matching former outbound ones. So, if TCP packet manages to get from my computer to the outside server, then the response should never be blocked.

Also, I don't understand how ICMP packets might get thru the router and crash on my iptables - they all should be be blocked in the router (note, however that all ICMPs that arrive at my iptables are on port 80, maybe this is a clue)

Could someone point me in the right direction either about how to fix those problems (if there are any, maybe I'm uninformed).

Answer 1

ICMP is necessary for proper IP operations don't block them, although you can block ICMP echo requests. There is no ICMP port 80, but you are likely getting unreachable messages for various websites on port 80. ICMP messages will not crash your iptables.

You should have ntp running and that will require port 123 open on UDP. DNS on port 53 should also be open on UDP and TCP.

If you are running Skype you should allow outgoing UDP and TCP on the ephemeral ports (32768 to 61000) on Ubuntu, as well as a few other. You will also need to allow UPD and TCP incomming on the port that Skype is using. See my post on Firewalling Skype.

You should expect some traffic on various ports from hosts inside your firewall. You will also receive packets from the Internet if you are on the IP address designtated as the DMZ on your router/firewall. The router firewall should also forward packets on related ports for protocols such as FTP.