1

I've setup a combination firewall (iptables), router, DHCP and DNS device running Ubuntu x64 at the edge of the network. Everything's working as expected, but I'm looking to keep the number of firewall rules to a minimum as the edge device changes in profile over time, like when additional VLANs (VLAN=dedicated NIC, in this case) or services are added to it.

Suppose the following:

wan0 = Wide Area Network / Internet access

ens123 = Local Area Network / VLAN235

ens456 = Servers / VLAN245

ens789 = Lab / VLAN335

Currently, it's using INPUT rules similar to the following to allow internal machines to access its services:

# allow DNS from lan
-A INPUT -i ens123 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i ens123 -p udp -m udp --dport 53 -j ACCEPT

# allow DNS from servers
-A INPUT -i ens456 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i ens456 -p udp -m udp --dport 53 -j ACCEPT

# allow dns from lab
-A INPUT -i ens789 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i ens789 -p udp -m udp --dport 53 -j ACCEPT


From looking at the iptables documentation and examples online, it looks like using a bang (!) should help by blacklisting only the WAN NIC, thus allowing everything else to connect to the edge from inside the various VLANs.

However, when I switch to using the following rule instead, machines from within a number of VLANs can't access DNS services running on the edge device anymore:

# allow DNS from not-wan
-A INPUT -i !wan0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i !wan0 -p udp -m udp --dport 53 -j ACCEPT
  1. Am I overlooking some small problem with my new rules?
  2. If not, what's your opinion of a simple way to manage such a setup using iptables?

Because of the nature of this, simple lines + less lines = more better. Let me qualify that: I'd really prefer to not have to touch the firewall at all if multiple VLANs were suddenly added to the network/edge; or, to only need to add one or two rules for the port(s) if another service is added to the edge.

3

You should put the "bang" (!) before -i, as interface name can consist of !.

  • I did not know an interface name could contain an exclamation mark! 15 years in and I'm still learning nuances of administrating Linux machines :) – intrand Oct 4 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.