Firewalling Basics

44Net Connect and Security

44Net Connect provides every device with a public facing IPv4 address, and does not inspect, filter, or block any traffic directed towards 44Net devices. Devices with publicly routable IP addresses face a constant barrage of traffic from various scanners and bots on the internet. Some of them are malicious, and correctly configuring your firewall is a key part of defending against them.

What does a firewall do?

At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet's source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device.

Outside connections to a public-facing service are typically allowed using a firewall rule that accepts all packets on the port that service is using, regardless of the packet's source IP. Private services, such as those only intended for your LAN, are typically protected by a firewall rule that only accepts packets whose source IP is inside your LAN. Packets sent to that port that originate externally will be dropped. You may have services that are only meant to be accessed from localhost, such as control interfaces accessed only by other software on the same device.

Stateful Firewalls

Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls, such as those based on iptables or nftables, are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic.

Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.

Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it's completely unrelated to all other packets.

Low Level Tools

iptables

iptables is a Linux firewall rule management tool that was deprecated in favor of nftables in 2014. It allows system administrators to define tables containing chains of rules for the treatment of packets. (To Do: Add Wikipedia citation) Both iptables and nftables use the netfilter framework to interface with the Linux kernel.

Modern systems no longer ship with an actual copy of iptables, instead using a compatibility layer that translates its rules to nftables.

nftables

nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the nft command line tool as well as editing /etc/nftables.conf. Changes made with the nft tool will not persist between reboots, and must be written into the config file to ensure persistence. It functions similarly to iptables, employing tables of chains of rules, but with no predefined chains and more flexible rules.