Firewalls - Revision history

KI5QKX: mw push

2026-03-01T00:14:54Z

mw push

← Older revision		Revision as of 00:14, 1 March 2026
Line 290:		Line 290:

	[[Category:Reference]]		[[Category:Reference]]
			[[Category:Infrastructure]]

KI5QKX at 20:28, 12 December 2024

2024-12-12T20:28:03Z

← Older revision		Revision as of 20:28, 12 December 2024
Line 286:		Line 286:
	option extra '-m set --match-set ipipfilter src'		option extra '-m set --match-set ipipfilter src'
	option name 'Ping_fromIPENCAPS'		option name 'Ping_fromIPENCAPS'



			[[Category:Reference]]

Cross: Mention OpenBSD and PF

2024-05-04T12:12:02Z

Mention OpenBSD and PF

← Older revision		Revision as of 12:12, 4 May 2024
Line 237:		Line 237:

	== Microtik ==		== Microtik ==

			== OpenBSD ==

			''See the Instructions for [[Setting up a gateway on OpenBSD]].''

			OpenBSD comes with a robust, flexible and highly performant firewall called "PF" that works well on AMPRNet. See https://www.openbsd.org/faq/pf/ for more information.

	== OpenWrt ==		== OpenWrt ==

Kb3vwg: /* OpenWrt */ added information about MSS Clamping

2019-04-25T16:17:08Z

OpenWrt: added information about MSS Clamping

← Older revision		Revision as of 16:17, 25 April 2019
Line 245:		Line 245:
	* [[Firewalls#iptables\|iptables]]-based scripts are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface - or into the Unified Configuration Interface (UCI) file ''/etc/firewall.user''		* [[Firewalls#iptables\|iptables]]-based scripts are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface - or into the Unified Configuration Interface (UCI) file ''/etc/firewall.user''
	* [[Firewalls#ipset\|ipset]]-based rules are entered on the command line - into the Unified Configuration Interface (UCI) file ''/etc/config/firewall'' ''(OpenWrt syntax must be used in this file!)''		* [[Firewalls#ipset\|ipset]]-based rules are entered on the command line - into the Unified Configuration Interface (UCI) file ''/etc/config/firewall'' ''(OpenWrt syntax must be used in this file!)''
			* '''MSS Clamping is enabled in the Firewall Section, you should enable this on both the AMPRLAN and AMPRWAN interfaces'''

	''Adding Bogon drop rule to OpenWrt (using [[Firewalls#ipset\|ipset]])''		''Adding Bogon drop rule to OpenWrt (using [[Firewalls#ipset\|ipset]])''

Kb3vwg: accidentally added my own subnet to ipset bogons, edited ipset to properly reflect

2019-01-21T20:54:24Z

accidentally added my own subnet to ipset bogons, edited ipset to properly reflect

← Older revision		Revision as of 20:54, 21 January 2019
Line 206:		Line 206:
	ipset -A bogons 203.0.113.0/24		ipset -A bogons 203.0.113.0/24
	ipset -A bogons 224.0.0.0/4		ipset -A bogons 224.0.0.0/4
	ipset -A bogons 240.0.0.0/4		ipset -A bogons 240.0.0.0/4
	ipset -A bogons 44.60.44.0/24		# Block of your own AMPRNet Subnet
			# ipset -A bogons 44.xxx.xxx.xxx/xx
	# Block of Test AMPRNet Subnet		# Block of Test AMPRNet Subnet
	# ipset -A bogons 44.128.0.0/16		# ipset -A bogons 44.128.0.0/16

Kb3vwg: added warning about using iptables on embeded devices - ipset prefered

2019-01-12T16:09:19Z

added warning about using iptables on embeded devices - ipset prefered

← Older revision		Revision as of 16:09, 12 January 2019
Line 36:		Line 36:
	* Since the IPENCAP Linux Kernel Module IPIP is in the kernel, '''you must set the default forwarding policy to DROP or REJECT.'''		* Since the IPENCAP Linux Kernel Module IPIP is in the kernel, '''you must set the default forwarding policy to DROP or REJECT.'''
	* ''If you set your default routing policy to ACCEPT, all packets that have not been explicitly DROPped or REJECTed elsewhere, will route, regardless of firewall policies.''		* ''If you set your default routing policy to ACCEPT, all packets that have not been explicitly DROPped or REJECTed elsewhere, will route, regardless of firewall policies.''
			* '''For most embedded devices, it is suggested to use [[Firewalls#ipset\|ipset]] rules instead'''

	'''General Bogon rules''' - see: https://en.wikipedia.org/wiki/Bogon_filtering		'''General Bogon rules''' - see: https://en.wikipedia.org/wiki/Bogon_filtering
Line 80:		Line 81:
	''NOTE:''		''NOTE:''

	* ''This script needs work, see Thu Jan 10 11:09:27 PST 2019 message in the [[44Net mailing list]] archive. Due to overheard running on many devices, the ipset script is suggested instead.''		* ''This script needs work, see Thu Jan 10 11:09:27 PST 2019 message in the [[44Net mailing list]] archive. Due to extreme overheard running on many devices, the ipset script is suggested instead.''
	* This rule (or one of the ipset or static rules below) is required for other AMPR nodes to initiate inbound traffic to your node.		* This rule (or one of the ipset or static rules below) is required for other AMPR nodes to initiate inbound traffic to your node.

Kb3vwg: add ipset bogon config

2019-01-12T16:05:24Z

add ipset bogon config

@@ Line 69: / Line 69: @@
   # Block of Test AMPRNet Subnet
   # iptables -t raw -I PREROUTING -s 44.128.0.0/16 -i tunl0 -j DROP
   ############################################################
   # THIS PREVENTS NESTED IPENCAP (BCP 38)
@@ Line 184: / Line 185: @@
 == ipset ==
 '''Dynamic IPENCAP Filtering of AMPR Nodes (using ipset)'''
@@ Line 213: / Line 240: @@
 ''See: [[Firewalls#iptables|iptables]] and [[Firewalls#ipset|ipset]] (above), and the Instructions for [[setting up a gateway on OpenWRT|setting up a gateway on OpenWRT]].''
-* [[Firewalls#iptables|iptables]]-based rules are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface
+* the Bogon ipset script is added to '''System > Startup''' on the web GUI - or into the Unified Configuration Interface (UCI) file ''/etc/rc.local''
-* [[Firewalls#ipset|ipset]]-based rules are entered on the command line - into the Unified Configuration Interface (UCI) file ''/etc/config/firewall''
+* [[Firewalls#iptables|iptables]]-based scripts are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface - or into the Unified Configuration Interface (UCI) file ''/etc/firewall.user''
 ''Adding IPENCAP Filtering of AMPR Nodes to OpenWrt (using [[Firewalls#ipset|ipset]])''

Kb3vwg: cleanup

2019-01-11T17:57:30Z

cleanup

← Older revision		Revision as of 17:57, 11 January 2019
Line 1:		Line 1:
	Welcome to the Firewall Wiki.		Welcome to the Firewall Wiki.

	~~NOTE:~~ This page is intended to be edited by the community to add use practices, command syntax, etc. regarding firewalling and security on AMPRNet nodes. While each operator is ultimately responsible for the administration of their node, it is highly suggested amongst the [[44Net mailing list]] Community that nodes be firewalled.		This page is intended to be edited by the community to add use practices, command syntax, etc. regarding firewalling and security on AMPRNet nodes. While each operator is ultimately responsible for the administration of their node, it is highly suggested amongst the [[44Net mailing list]] Community that nodes be firewalled.


	'''NOTE: On an iptables-based firewall, you must enable connection tracking on the tunl0 interface in order to enable Stateful Packet Inspection (i.e. a stateful firewall). Since the IPENCAP Linux Kernel Module IPIP is in the kernel, '''you must set the default forwarding policy to DROP or REJECT.''' If you set your default routing policy to ACCEPT, all packets that have not been explicitly DROPped or REJECTed elsewhere, will route, regardless of firewall policies.'''

	== Cisco ==		== Cisco ==
Line 11:		Line 9:
	== DD-WRT ==		== DD-WRT ==

	DD-WRT uses an iptables-based firewall (see iptables below). Custom rules can be entered at Administration > Commands > "Save Firewall"		DD-WRT uses an iptables-based firewall (see iptables below). Custom rules can be entered at '''Administration > Commands > "Save Firewall"''' on the web GUI.

	~~https~~:~~//www.dd-wrt.com/wiki/index.php/Iptables~~		See:

	https://www.dd-wrt.com/wiki/index.php/Firewall		* https://www.dd-wrt.com/wiki/index.php/Iptables
			* https://www.dd-wrt.com/wiki/index.php/Firewall

	== D-Link ==		== D-Link ==
Line 23:		Line 22:
	To enable input of IPENCAP (IP Protocol Number 4) '''Note: this rule is required for other AMPR nodes to initiate inbound traffic to your node.'''		To enable input of IPENCAP (IP Protocol Number 4) '''Note: this rule is required for other AMPR nodes to initiate inbound traffic to your node.'''

	In Port Forwarding		In Port Forwarding on the web GUI:

			* Create a new Port Forward
			* Enter the LAN IP of your AMPR node
			* Select "Other"
			* Type the number '''4''' into the field

	~~# Create a new Port Forward~~		== iptables ==
	~~# Enter the LAN IP of your AMPR node~~
	~~# Select "Other"~~
	~~# Type the number '''4''' into the field~~

			'''NOTE:'''

	== iptables ==		* On an iptables-based firewall, you must enable connection tracking on the tunl0 interface in order to enable Stateful Packet Inspection (i.e. a stateful firewall).
			* Since the IPENCAP Linux Kernel Module IPIP is in the kernel, '''you must set the default forwarding policy to DROP or REJECT.'''
			* ''If you set your default routing policy to ACCEPT, all packets that have not been explicitly DROPped or REJECTed elsewhere, will route, regardless of firewall policies.''

	'''General Bogon rules''' - see: https://en.wikipedia.org/wiki/Bogon_filtering		'''General Bogon rules''' - see: https://en.wikipedia.org/wiki/Bogon_filtering

Kb3vwg: /* OpenWrt */ moved OpenWrt rules here

2019-01-11T15:51:50Z

OpenWrt: moved OpenWrt rules here

@@ Line 205: / Line 205: @@
 == Microtik ==
-== OpenWRT ==
+== OpenWrt ==
-See: iptables and ipset (above), and the Instructions for [[setting up a gateway on OpenWRT|setting up a gateway on OpenWRT]].
+''See: [[Firewalls#iptables|iptables]] and [[Firewalls#ipset|ipset]] (above), and the Instructions for [[setting up a gateway on OpenWRT|setting up a gateway on OpenWRT]].''
-iptables-based rules can be entered in Network > Firewall > Custom Firewall on the LuCI web interface; or via the command prompt via UCI.
+* [[Firewalls#iptables|iptables]]-based rules are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface

Kb3vwg: /* ipset */ cleanup

2019-01-11T15:35:38Z

ipset: cleanup

@@ Line 183: / Line 183: @@
 '''Dynamic IPENCAP Filtering of AMPR Nodes (using ipset)'''
-'''REQUIRED: [[ampr-ripd]] (using the -x and -d arguments) and the ipset package.'''
+To enable dynamic filtering of IPENCAP (IP Protocol Number 4)
   #!/bin/sh
@@ Line 200: / Line 202: @@
       ipset -A ipipfilter $ip
   done
 == Microtik ==