3

I have a router that runs Tomato, so I have access to iptables. There's a device on my network with an IP address of 192.168.1.100. I don't want it to send data to the Internet except for a very specific case.

Specifically, I don't want it to send outgoing data to the Internet at all except for secure SMTP (TCP port 587 or 465) and even then, just to one SMTP server. Incoming traffic is a concern too, but blocking outbound is more important. It should continue to allow LAN traffic, so packets with an origin and destination of 192.168.1.0/24 are fine.

I don't know much about iptables so I'm not sure how to go about doing this, or if iptables is even the best approach. I've set up rules before that drop packets, but I've never set one up that blocks everything but packets that meet specific requirements.

How would you suggest I go about doing this?

  • iptables -L Post the results it would help making compatible with your system. – cybernard May 12 '16 at 3:40
3

If you don't have a rule to permit ESTABLISHED,RELATED traffic the traffic may not get through at all.

iptables -I INPUT 1 -m conntrack -j ACCEPT  --ctstate RELATED,ESTABLISHED
iptables -A OUTPUT -m tcp -p tcp -m multiport --dports 587,465 -d <ipaddress of smtp> -j ACCEPT
iptables -A OUTPUT -s 192.168.1.100 -j DROP
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.1.0/24 -m tcp -p tcp -m multiport --dports 587,465 -j ACCEPT 
iptables -A FORWARD -s 192.168.1.100 !-d 192.168.1.0/24,<ipaddress of smtp> -j DROP

permit,permit, and then deny all other traffic.

However, without knowing what other rules you have, I can't tell you where to put them.

The order the rules are in is critical

The rules are processed in order, and if you add my rules to the end of an existing set of rules they may not work right.

1

All you need is to drop outbound traffic from your host with rules like that:

iptables -A FORWARD -s 192.168.1.100 -p tcp --dports 80 -j ACCEPT 
iptables -A FORWARD -s 192.168.1.100 -j DROP

The first rule will allow your device to use HTTP protocol for any host, and the second one will ban any other traffic outside of your home network.

If you need to allow all the traffic to spectacular host you'll need to use something like that instead:

iptables -A FORWARD -s 192.168.1.100 -d 8.8.8.8 -j ACCEPT 
iptables -A FORWARD -s 192.168.1.100 -j DROP

Your device will be able to connect to the IP 8.8.8.8 with any protocol, but will be denied for all others.

You can look for more examples here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.