Arch Linux

arch_CM

Member

Registered: 2018-01-24

Posts: 3

NFTables firewall: Webserver

Hi, I recently embarked on a little project, setting up a webserver to host GPS tracking units, I'm the type of guy that wants to know how stuff works, and see if I can do it myself. So I read almost everywhere that nftables is the successor to iptables, and starting searching for a type of guide to setting up a firewall for the webserver. But that's not really how it works.

After a while I stumbled onto https://kyau.net/wiki/ArchLinux:Security, which is a short guide to hardening arch linux, and at the end of the article an example of a firewall (using nftables) was shown.

#!/usr/bin/nft -f
# ipv4/ipv6 Simple & Safe Firewall
# you can find examples in /usr/share/nftables/

table inet filter {

  chain input {
    type filter hook input priority 0;

    # allow established/related connections
    ct state {established, related} accept

    # early drop of invalid connections
    ct state invalid drop

    # allow from loopback
    iifname lo accept

    # no ping floods
    ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate 10/second accept
    ip protocol icmp icmp type echo-request limit rate 10/second accept

    # allow ssh, but with brute force protection
    tcp dport ssh limit rate 15/minute accept

    # allow http and https traffic
    tcp dport {http,https} accept

    # everything else (blackhole)
    reject with icmp type port-unreachable
  }

  # all forwarding traffic gets dropped (we are not a router)
  chain forward {
    type filter hook forward priority 0;
    drop
  }

  # let all traffic outbound through the firewall
  chain output {
    type filter hook output priority 0;
    accept
  }

}

My question, if I wanted to allow the GPS units to communicate with the server, do I need to allow specific ports through the firewall for it? My common sense tells me the answer is yes, so how would one setup the firewall to allow the units through a specific port?
I thought I should put in the following:

# allow GPS 
tcp dport 4000 counter accept

Port 4000 will be open to the GPS units.
Would the code above be sufficient? And what would be any possible risks?

ayekat

Member

Registered: 2011-01-17

Posts: 1,634

Re: NFTables firewall: Webserver

Hi arch_CM, and welcome!

Arch Linux has quite an extensive Wiki. It's generally recommended that you start there when you search informations on a certain topic/software (that, or upstream documentation—but we can't help you with issues caused by following third-party guides found in random places on the Web¹). There is an nftables article, for instance.

My question, if I wanted to allow the GPS units to communicate with the server, do I need to allow specific ports through the firewall for it? My common sense tells me the answer is yes, so how would one setup the firewall to allow the units through a specific port?

Depends—how do the units communicate with your server? My common sense tells me the answer is no, because you put "webserver" in your thread title, and I therefore expect that the GPS units communicate with the webserver (in which case you just need to open the ports on which your webserver is listening).
Or where does that port 4000 come from?

Also, slightly unrelated but noteworthy: I suggest for the well-being of your networking that you accept all ICMP packets, not just the echo requests ("pings"). Something like the following rule after the rate-limiting rule:

...
ip protocol icmp accept
ip6 nexthdr icmpv6 accept

And since those rules handle returning ICMP replies, you no longer need to accept the "RELATED" packets (unless you plan to set up and use a connection tracker ("conntrack") to support things like FTP connections²).

_____
¹ Also, the link is dead for me (none of the associated DNS servers for "kyau.net" seem to work, so the domain cannot be resolved).
² Which is a protocol that should have died a long time ago, IMHO.

---

pkgs │ hacks │ cfg │ blag

arch_CM

Member

Registered: 2018-01-24

Posts: 3

Re: NFTables firewall: Webserver

Hi ayekat thank you for the quick reply!

Depends—how do the units communicate with your server? My common sense tells me the answer is no, because you put "webserver" in your thread title, and I therefore expect that the GPS units communicate with the webserver (in which case you just need to open the ports on which your webserver is listening).

I think I should probably get back to more reading; the GPS units connect via GPRS and the TCP/UDP protocols. So the firewall should allow the port to which the webserver is listening for the GPS unit? 

Or where does that port 4000 come from?

Port 4000 was just a random number I chose for an example, sorry for not mentioning.

Thanks for the suggestion.

I suggest for the well-being of your networking that you accept all ICMP packets, not just the echo requests ("pings").

Also, regarding the link, I also tried following it now, it seems down, I recall that they had a banner message stating that they were revamping the site.

ayekat

Member

Registered: 2011-01-17

Posts: 1,634

Re: NFTables firewall: Webserver

the GPS units connect via GPRS and the TCP/UDP protocols

Yes, GPRS is used by the units to connect to the Internet (I think you can compare it to cable or phone lines for household Internet access).

The Internet Protocol (IP) is then a layer on top of that. And TCP/UDP are layers on top of IP. And HTTP is a layer on top of TCP.
It's all layers (a very simplified way to look at it is the OSI model).

So the firewall should allow the port to which the webserver is listening for the GPS unit?

The web server simply waits for new TCP/IP connections on a port (by default 80 and/or 443 for HTTP(S)), and then handles the requests. There should be no need to open special ports for the GPS units.

... that is, unless I'm not seeing the full picture, and the GPS units do require additional ports to be open—but it's hard to tell without any given information.
Also, have you verified that your web server is publicly accessible (not running behind a NAT, like a household router)?

---

pkgs │ hacks │ cfg │ blag

arch_CM

Member

Registered: 2018-01-24

Posts: 3

Re: NFTables firewall: Webserver

It's all layers smile (a very simplified way to look at it is the OSI model).

Quite useful, thank you. So much is making sense now!

... that is, unless I'm not seeing the full picture, and the GPS units do require additional ports to be open—but it's hard to tell without any given information.
Also, have you verified that your web server is publicly accessible (not running behind a NAT, like a household router)?

Yes I've verified, and I believe my questions have been answered.
I will take a look at everything this week, and if need be, make another post.

Thank you very much!