IPTables default security rules for a gateway/router?

Question

On a router such as dd-wrt or tomato, what would be some default iptables rules?

I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic iptables rules that are a must for a router/gateway. Sort of like how anti-virus is 'defacto' when securing a computer.

Answer 1

Right, so this is is a Hard Question^tm. Since all environments are different, it is very tricksome to provide a "One Size Fits All" ruleset that one can expect to just drop in. Any such configs, config snippets, recommendations, etc, must be fully grokked and tweaked to work in your environment. That being said, as discussed in the security.blogoverflow.com post (and in much greater detail), Base Rulesets in IPTables, this is a pretty basic set of sanity checks that I've built out over the years and have been recommending to people.

## Section 1
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp --icmp-type any -j ACCEPT
## Section 2
# Force SYN checks
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP
# Drop all fragments
-A INPUT -f -j DROP
# Drop XMAS packets
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP
# Drop NULL packets
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP
## Section 3
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
###
# Insert your system specific rules here
###
## Section 4
-A INPUT -j LOG --log-level 7 --log-prefix "IPTABLES Dropped: "
-A INPUT -j DROP

Section 1

This is you pretty basic accepts. In general, you just want to allow ping and any localhost traffic or else things may not necessarily work as expected.

Section 2

This is a series of quick and dirty checks for known wonky packets that can cause problems. The only reason we put this second is for performance reasons.

Section 3

Here we allow all packets that are part of an existing session to come in. Most firewall admins would say to put this at the beginning of the config, performance reasons and all that. However, I would rather wonky packets be blocked even when part of an on-going session.

Section 4

Here is our log and default deny. The downside of putting the log message all the way down here, is that we won't get notified if any the wonky drops are triggered. We could move it up to the top, but that would either:

• Make our config really messy
• Overwhelm the logging engine

Really, it's your choice. As a generic recommendation, I opted for cleaner so that it would be easier to understand.

Answer 2

I think the smallest most "defacto" firewall is something like this:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -m state --state NEW -i ! WAN0 -j ACCEPT

Accept all connections initiated by your local network and block everything from the outside. It's the wide propagation of statefull firewall rules like these that have shifted attack vectors to the browser and other exploits initiated by the user/victim/target.

If you are interested in what rules are running in Tomato and WRT you can SSH into those distributions and look at the firewall scripts.