1

What I mean by ``directly communicate''

Does it ever need to receive packets with the gateway's IP address as the source IP address, or send packets with the gateway's IP address as the destination IP address?

(I would still allow ICMP request-echo, reply, no route to host, and time exceeded.)

My current setup

My physical Linux server is behind a router which handles DHCP (I don't use that with the server. Static IP configured at boot), some (basic) firewalling, and NAT. It's not live yet, so at the moment downtime isn't an issue.

Why I'm asking

As I was blocking access to local network addresses in iptables, I was about to put in exceptions (-j RETURN rules in the private network address filtering chains) for the gateway address, when I stopped and wondered whether that would actually be necessary.

I don't administer the router from the server, and I don't want any program on the system to be able to do that, or change my local IP or anything along those lines, so if I understand NAT correctly disallowing traffic to/from that IP shouldn't break anything.

But I'm not confident enough about my networking to say for sure, so I thought that, before I possibly messed something up (especially something subtle like a less secure but hard-to-notice configuration change), I thought I'd do a bit of crowdsourcing on the decision.

Explanation if this is a stupid question

This is the first publicly-accessible server I've ever deployed so I'm actively trying to form as many good habits- and as few bad- as possible...

Improve this question
1
  • ...After the question has been answered, and the answer accepted, and everything to do with the question pretty well resolved, some idiot moves this to Superuser? My question wasn't "Does my desktop need to access the gateway?", it was "Does my server?", and the question was specifically motivated by security concerns- sigh... Whatever. This is the site that people recommend questions be moved when they feel smugly superior, and that's just the way things are.
    – Parthian Shot
    Jul 13, 2014 at 2:55

1 Answer 1

Reset to default
2

You should never need to communicate directly to a pure NAT gateway (ie. a device that does port/address rewriting and nothing else).

However, you probably don't have one of those. The typical home router provides, in addition to NAT, DHCP, DNS resolving, possibly an NTP server, UPnP hole-punching, and assorted other services. If you're sure your server doesn't use any of them (in particular, DNS resolution), you can set up the server's firewall to block contact.

Improve this answer
7
  • DNS -- At the moment, I only anticipate needing DNS relatively infrequently for things like installing updates and maybe checking the hostnames of connecting hosts. In light of that, do you think it might be a good idea to just set the default primary and secondary DNS servers to 8.8.8.8 and 8.8.4.4 (or something similar)?
    – Parthian Shot
    Jul 12, 2014 at 5:57
  • NTP -- I'm using the ..pool.ntp.org servers. So that probably shouldn't be an issue.
    – Parthian Shot
    Jul 12, 2014 at 5:58
  • UPnP -- ...I'm not sure. I'm pretty sure I don't, though. And from what I'm reading, it seems like exactly the kind of thing I'd want to avoid (punching universally accessible holes in the NAT).
    – Parthian Shot
    Jul 12, 2014 at 6:03
  • Thank you, by the way. I wouldn't have guessed it did much more than NAT, DHCP, and maybe DNS. Guess I should look into what other services it (may be) providing.
    – Parthian Shot
    Jul 12, 2014 at 6:04
  • For DNS, you might wish to stick a caching DNS resolver on the server.
    – Mark
    Jul 12, 2014 at 7:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .