Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules:

$IPTABLES -A OUTPUT  -d 10.0.0.255   -j DROP
$IPTABLES -A FORWARD  -d 10.0.0.255   -j DROP

It doesn't seem to work. Packages are still flowing through this rule and the DENY of them are getting logged at a later rule. Do I need to anything special when it comes to the broadcast addr.?

Edit: Here is the full rule I use that isn't working:

# 
# Rule 2 (wlan0)
# 
echo "Rule 2 (wlan0)"
# 
# remove local broadcast 
$IPTABLES -A FORWARD -i wlan0   -d 10.0.0.255   -m state --state NEW  -j DROP
$IPTABLES -A OUTPUT -o wlan0   -d 10.0.0.255   -m state --state NEW  -j DROP
$IPTABLES -A FORWARD -o wlan0   -d 10.0.0.255   -m state --state NEW  -j DROP
share|improve this question
    
What is your netmask? By convention the netmask for a address starting with 10 is 255.0.0.0, so the boardcast address ist 10.255.255.255 –  Hendrik Brummermann Jul 10 '11 at 11:14
    
inet addr:10.0.0.4 Bcast:10.0.0.255 Mask:255.255.255.0 –  grm Jul 10 '11 at 11:34
1  
Which direction are you trying to block? Broadcasts packets from your system, or broadcast packets from other systems? –  Scott Pack Jul 10 '11 at 12:45
    
hi, it's from other systems. I have a rule later that deny all traffic and log the deny. Issue is that I don't want this later rule to log broadcasted packets from other system so the rule above tries to drop them silently early. –  grm Jul 10 '11 at 13:11
    
I'm thoroughly confused. Your starting example lists -d 10.0.0.255, but the full rules list -d 10.0.0.0/24, which is not the same thing. Also it is hard to tell whether you are trying to block inbound broadcast packets (so you don't even see them), or trying to prevent them from being forwarded. –  D.W. Aug 4 '11 at 4:27

3 Answers 3

I believe the correct rule would be:

$IPTABLES -A OUTPUT  -d 10.0.0.0/24   -j DROP
$IPTABLES -A FORWARD  -d 10.0.0.0/24   -j DROP

I'm not sure why your rule doesn't match broadcast packages, but in other examples I've seen this format.

Also, an alternative way found here blocks packet based on packet type.

share|improve this answer
1  
Nope, that'll block non-broadcast packets too. For instance, it'll block packets destined to 10.0.0.17. –  D.W. Aug 4 '11 at 4:24
    
It seems like you are right... –  Dog eat cat world Aug 14 '11 at 12:44

The question is not very explicit about what you are trying to achieve, what behavior you actually observe, and how that differs from what you are trying to achieve. However, I'll try to do my best to guess at what your problem might be.

Here's my guess. You almost certainly need an INPUT rule to block incoming broadcasts. I would expect your current rulesets to prevent local applications from sending broadcasts, but it will not block incoming broadcast messages sent by other machines.

I hope you understand that these rules are only going to block incoming/outgoing broadcasts over your wireless interface (wlan0). If you want to block all broadcasts, regardless of interface, delete the -i wlan0.

I hope you understand that blocking forwarding of broadcast packets makes no sense. Broadcast packets are, well, broadcast to everyone on the local network. So if machine X on the local wireless network sends a broadcast packet, then all other machines on the same wireless network are going to see the broadcast packet, regardless of what firewall rules you put in place. The FORWARD rules (and the whole concept of preventing broadcast packets from "flowing through") your machine just doesn't make sense.

P.S. If none of the above work, try deleting -m state --state NEW, in case that is messing things up. Most likely this won't make a difference. However, I know I'm able to block incoming broadcasts in my ruleset, and my ruleset doesn't try to filter on connection state, so I know it should work if you leave out the -m state --state NEW; it should still work with that included, but I don't know that for certain.

share|improve this answer
    
Thanks for the help and pointer to the input rule. I will investigate that. Just so it's clear, what I try to achieve is to prevent logging of the packets. I log all packets at the end that gets denied so I wanted to explicit deny them early without logging to prevent this logging. –  grm Aug 16 '11 at 22:55
1  
FORWARD rule isn't duplicated because -o and -i distinguish direction. There isn't a "to or from" specifier for an interface. –  Andy Lee Robinson Aug 18 '11 at 12:44
    
@Andy, you are quite right! My apologies. I've edited my answer to remove my erroneous statement about this. I apologize for my confusion. –  D.W. Aug 18 '11 at 23:00

iptables is wonderful when the schema is thoroughly thought out and optimised for the environment, but it requires serious intellectual effort to get right!

I think of it like this:

INPUT - to the box
FORWARD - around the box
OUTPUT - from the box

You appear to have subnetted Class A 10.* to a Class C 10.0.0.* I assume you want 10.0.0.255 broadcasts on eth0/eth1.

Therefore, to block just broadcasts on 10.0.0.255 to and from wlan0 and prevent them being forwarded:

$IPTABLES -A FORWARD -i wlan0 -d 10.0.0.255/32 -j DROP
$IPTABLES -A FORWARD -o wlan0 -d 10.0.0.255/32 -j DROP
$IPTABLES -A INPUT   -i wlan0 -d 10.0.0.255/32 -j DROP
$IPTABLES -A OUTPUT  -o wlan0 -d 10.0.0.255/32 -j DROP

To block the forwarding for 10.0.0.255/32 on all interfaces:

$IPTABLES -A FORWARD -d 10.0.0.255/32 -j DROP

This would still allow it to be used, but won't cross interfaces in any direction.

I would also add a lot more rules to stop spoofing, bogons, selected icmps and igmp and lock down exactly what addresses/ports get forwarded and blocked to/from each combination of interfaces, so that there is no chance of private addresses leaking to the net, or spoofed addresses getting in, or one hacked machine getting into other machines that it shouldn't.

My iptables ruleset is around 25,000 lines, but most of those are geoip rules to decide what countries can send mail at what times, as well as banned users, brute force attackers, known spamhaus offenders etc.

Maybe I'm paranoid, but as a system administrator it is required!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.