Quick help with stateless firewall

Hello,

I have the following simpel stateless firewall... the issue is iam not able to send ICMPs queries from within the machine. What could I modify or add for this to be able to happen . Also iam only intending to run a HTTP service and DNS service is it fine the way it is?

Also, I intend to keep the script stateless not wanting to use conntrack at all.

Thanks
Alex

#!/bin/bash

/sbin/iptables -F
/sbin/iptables -X

/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT ACCEPT

#Accept SSH
/sbin/iptables -A INPUT -p tcp -m tcp -s 204.199.62.74 --dport 22 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 1000:65535 -j ACCEPT /sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT /sbin/iptables -A INPUT -p tcp --dport 53 -j ACCEPT

I think you need this,

iptables -I INPUT -p icmp --icmp-type 8 -j ACCEPT

You can also do -j LOG to see what makes it to a certain place in the chain.

Bryan

IPv4 doesn't work very well without ICMP; generally, one should always accept it, in and out. However, it's OK to drop icmp-type=8 (ECHO requests) on input from non-local sources when the system should not respond to pings from others.

There are no ICMP rules at all in your example , I would reckon you need 2 rules on a stateless firewall ( atleast ).

ONE for ICMP type 8 on OUTPUT ( your machine sending ECHO REQUEST ) , not need as long as you have ACCEPT for all OUTPUT . and ONE for ICMP type 0 on INPUT ( other machines sending ECHO REPLY back to your machine ) .

/sbin/iptables -A OUTPUT -p icmp -icmp-type 8 -j ACCEPT /sbin/iptables -A INPUT -p icmp -icmp-type 0 -j ACCEPT

If you want others to be able to ping your machine you do the reverse way with the rules !

And since you ONLY need 2 services , you may want to remove this rule /sbin/iptables -A INPUT -p tcp --dport 1000:65535 -j ACCEPT

If you need to allow for outgoing return traffic you should allow source-services you need/use . /sbin/iptables -A INPUT -p tcp --sport 80 --dport 1025:65535 -j ACCEPT /sbin/iptables -A INPUT -p tcp --sport 53 --dport 1025:65535 -j ACCEPT /sbin/iptables -A INPUT -p udp --sport 53 --dport 1025:65535 -j ACCEPT

And same for OUTPUT ( unless you continue with all ACCEPT ) /sbin/iptables -A OUTPUT -p tcp --dport 80 --sport 1025:65535 -j ACCEPT /sbin/iptables -A OUTPUT -p tcp --dport 53 --sport 1025:65535 -j ACCEPT /sbin/iptables -A OUTPUT -p udp --dport 53 --sport 1025:65535 -j ACCEPT Or just
/sbin/iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT /sbin/iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT /sbin/iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

As a common rule with stateless firewalls YOU might wanna accept 2 more ICMP types

/sbin/iptables -A OUTPUT -p icmp -icmp-type 3 -j ACCEPT /sbin/iptables -A OUTPUT -p icmp -icmp-type 11 -j ACCEPT /sbin/iptables -A INPUT -p icmp -icmp-type 3 -j ACCEPT /sbin/iptables -A INPUT -p icmp -icmp-type 11 -j ACCEPT

Type 3 is used for all types of "unreachable" messages , and type 11 is "time exceed" - most commonly used for traceroute replies , but it is also sent for packets that travel "too far" :)

Best regards
André Paulsberg
Senior Network Engineer
Core Network
Operation, Network, Nordic Operations
[email protected]
M +47 xxx yyyyy