Editing Linux router with WAN, LAN and DMZ (section)

== Minimal firewall ==
Default deny inbound and forwarded, allow outbound, and let conntrack carry
return traffic. Everything published from the DMZ is opened explicitly.

=== Policies and baseline ===
<syntaxhighlight lang="bash">
# Start from a clean slate
iptables -F
iptables -t nat -F
iptables -X

iptables -P INPUT   DROP
iptables -P FORWARD DROP
iptables -P OUTPUT  ACCEPT

# Loopback, and anything conntrack already knows about
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
</syntaxhighlight>

=== Services on the router itself ===
Only from the LAN. Nothing on the router listens to the WAN.
<syntaxhighlight lang="bash">
iptables -A INPUT -i eth1 -p tcp --dport 22  -j ACCEPT   # ssh
iptables -A INPUT -i eth1 -p udp --dport 67  -j ACCEPT   # dhcp server
iptables -A INPUT -i eth1 -p udp --dport 123 -j ACCEPT   # ntp server
iptables -A INPUT -i eth1 -p udp --dport 53  -j ACCEPT   # dns, if the router resolves
iptables -A INPUT -i eth1 -p tcp --dport 53  -j ACCEPT

# Ping, rate limited, from anywhere
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/s -j ACCEPT
</syntaxhighlight>

=== Publish the DMZ servers (DNAT) ===
<code>25</code> is plain SMTP with STARTTLS, <code>587</code> is the submission
port (also STARTTLS) and <code>465</code> is implicit TLS submission. Drop
whichever of the two submission ports your mail server does not offer.

<syntaxhighlight lang="bash">
# Mail -> 10.0.0.10
iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport \
         --dports 25,465,587,993 -j DNAT --to-destination 10.0.0.10

# Web -> 10.0.0.20
iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport \
         --dports 80,443 -j DNAT --to-destination 10.0.0.20
</syntaxhighlight>

DNAT only rewrites the destination. The packet still has to survive
<code>FORWARD</code>, which is where the matching accepts belong:

<syntaxhighlight lang="bash">
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP

iptables -A FORWARD -i eth0 -o eth2 -d 10.0.0.10 -p tcp -m multiport \
         --dports 25,465,587,993 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth2 -d 10.0.0.20 -p tcp -m multiport \
         --dports 80,443 -j ACCEPT
</syntaxhighlight>

=== Egress and inter-zone policy ===
<syntaxhighlight lang="bash">
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT   # LAN  -> internet
iptables -A FORWARD -i eth2 -o eth0 -j ACCEPT   # DMZ  -> internet (updates, outbound mail)
iptables -A FORWARD -i eth1 -o eth2 -j ACCEPT   # LAN  -> DMZ (administration)

# DMZ -> LAN is deliberately absent. That asymmetry is the whole point of a
# DMZ: if a published server is compromised it must not reach the LAN.
# Return traffic for LAN-initiated connections is already covered by the
# ESTABLISHED,RELATED rule above.
</syntaxhighlight>

=== Source NAT ===
<syntaxhighlight lang="bash">
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
</syntaxhighlight>

<code>MASQUERADE</code> takes the WAN address as it finds it, which is what you
want on a dynamic ISP address. On a static WAN address <code>SNAT</code> is
marginally cheaper because it does not look the address up per connection:

<syntaxhighlight lang="bash">
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 203.0.113.10
</syntaxhighlight>

=== Reaching the servers from the LAN ===
A LAN client resolving the public name gets the WAN address, sends the packet to
the router, and the reply comes back from <code>10.0.0.10</code> directly —
so the connection never completes. Either give the LAN a split-horizon DNS view
that answers with the internal address, or add hairpin NAT:

<syntaxhighlight lang="bash">
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -d 10.0.0.10 -p tcp -m multiport \
         --dports 25,465,587,993 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -d 10.0.0.20 -p tcp -m multiport \
         --dports 80,443 -j MASQUERADE
</syntaxhighlight>

Split-horizon DNS is the tidier of the two — hairpin NAT hides the client's real
address from the server, so its logs show the router for every internal visitor.