1

Okay, I'm running a router with shibby tomato (linux based) v1.28-115 and have a bridge network setup (br1) that consists of a guest wifi.

I want to only allow access to specific outbound ports... what do I need in my firewall script?

copy-paste issues, answering my own question

  • I originally had my non-working script here.. it had some double --state entries, once I corrected the bad syntax, and adjusted the order, all was working, Answered my own question below. – Tracker1 Nov 26 '13 at 19:52
1

Here is my working script.. which may not be correct... I don't want to mess up rules outside this script in the rest of the config for nat/etc.. it's a consumer appliance and not wanting to put more than needed.

#default deny guest
iptables -I FORWARD -i br1 -j DROP

#Removes guest access to physical network
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP

#Removes guest access to the router's config GUI/ports
iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset

#guest allow dns to router
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT

#Guest - allow explicit ports
#Guest to ftp
iptables -I FORWARD -i br1 -p tcp --dport 21 -m state --state NEW -m limit --limit 4/min -j ACCEPT
#guest to ssh
iptables -I FORWARD -i br1 -p tcp --dport 22 -m state --state NEW -m limit --limit 4/min -j ACCEPT
#guest to telnet
iptables -I FORWARD -i br1 -p tcp --dport 23 -m state --state NEW -m limit --limit 4/min -j ACCEPT
#guest to smtp/smtp+ssl
#iptables -I FORWARD -i br1 -p tcp --dport 25 -m state --state NEW -m limit --limit 4/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 2525 -m state --state NEW -m limit --limit 4/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 465 -m state --state NEW -m limit --limit 4/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 587 -m state --state NEW -m limit --limit 4/min -j ACCEPT
#guest to pop3/ssl
iptables -I FORWARD -i br1 -p tcp --dport 110 -m state --state NEW -m limit --limit 16/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 995 -m state --state NEW -m limit --limit 16/min -j ACCEPT
#guest to imap/ssl
iptables -I FORWARD -i br1 -p tcp --dport 143 -m state --state NEW -m limit --limit 16/min -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 993 -m state --state NEW -m limit --limit 16/min -j ACCEPT
#guest http/https
iptables -I FORWARD -i br1 -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 8080 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 443 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br1 -p tcp --dport 8443 -m state --state NEW -j ACCEPT

#Guest - allow established connections
iptables -I FORWARD -i br1 -m state --state RELATED,ESTABLISHED -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.