Ignoring broadcasts to 10.0.0.255 using iptables

Question

I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules:

$IPTABLES -A OUTPUT  -d 10.0.0.255   -j DROP
$IPTABLES -A FORWARD  -d 10.0.0.255   -j DROP

It doesn't seem to work. Packages are still flowing through this rule and the DENY of them are getting logged at a later rule. Do I need to anything special when it comes to the broadcast addr.?

Edit: Here is the full rule I use that isn't working:

# 
# Rule 2 (wlan0)
# 
echo "Rule 2 (wlan0)"
# 
# remove local broadcast 
$IPTABLES -A FORWARD -i wlan0   -d 10.0.0.255   -m state --state NEW  -j DROP
$IPTABLES -A OUTPUT -o wlan0   -d 10.0.0.255   -m state --state NEW  -j DROP
$IPTABLES -A FORWARD -o wlan0   -d 10.0.0.255   -m state --state NEW  -j DROP

Answer 1

A bit dated, but I felt compelled to help expand the discussion/dialog by introducing the idea of blocking broadcast traffic by demonstrating the capabilities of IPTables to filter layer 2 information as well. Specifically, there's the -m pkttype --pkt-type broadcast command line option.

Here is an example iptables ruleset that demonstrates this option as well as its resultant output:

IPTables: -m pkttype --pkt-type broadcast

iptables -F

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

iptables -A INPUT -m pkttype --pkt-type broadcast -d 10.0.0.255/32 -j DROP
iptables -A INPUT -j ACCEPT

iptables -A FORWARD -m pkttype --pkt-type broadcast -d 10.0.0.255/32 -j DROP
iptables -A FORWARD -j ACCEPT

iptables -A OUTPUT -m pkttype --pkt-type broadcast -d 10.0.0.255/32 -j DROP
iptables -A OUTPUT -j ACCEPT

RESULTS

[nick@sys]$ iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             10.0.0.255          PKTTYPE = broadcast 
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             10.0.0.255          PKTTYPE = broadcast 
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             10.0.0.255          PKTTYPE = broadcast 
ACCEPT     all  --  anywhere             anywhere            

While a tangent, there is another interesting option to provide layer-2 filtering based on (source) MAC addresses, which isn't too useful in this case. However, it is interesting if nothing more than to know of its existence. This is the IPTables -m mac --mac-source command line option. Practically-speaking this option is declared to make sense on INPUT and FORWARD chains (and not the OUTPUT chain). The concept would likely be of more interest for an ACCEPT, versus a DROP or REJECT, action. In the following brief example I ACCEPT broadcasts from the default gateway, but block all others. In this example I pretend the MAC address of the default gateway is: 00:F0:10:03:15:42.

IPTables: -m mac --mac-source

iptables -F

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

iptables -A INPUT -m mac --mac-source 00:F0:10:03:15:42 -d 10.0.0.255/32 -j ACCEPT
iptables -A INPUT -m mac ! --mac-source 00:F0:10:03:15:42 -d 10.0.0.255/32 -j DROP
iptables -A INPUT -j ACCEPT

iptables -A FORWARD -d 10.0.0.255/32 -j DROP
iptables -A FORWARD -j ACCEPT

iptables -A OUTPUT -d 10.0.0.255/32 -j DROP
iptables -A OUTPUT -j ACCEPT

RESULTS

[nick@sys]$ iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             10.0.0.255          MAC 00:F0:10:03:15:42 
DROP       all  --  anywhere             10.0.0.255          MAC ! 00:F0:10:03:15:42 
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             10.0.0.255          
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             10.0.0.255          
ACCEPT     all  --  anywhere             anywhere

In this second example I fully realize that the NOT (i.e., '!') notation for the second INPUT rule isn't necessary; however, it is also a neat feature that can be of some use in this question if selective rejection (or acceptance) is desired.

Answer 2

The question is not very explicit about what you are trying to achieve, what behavior you actually observe, and how that differs from what you are trying to achieve. However, I'll try to do my best to guess at what your problem might be.

Here's my guess. You almost certainly need an INPUT rule to block incoming broadcasts. I would expect your current rulesets to prevent local applications from sending broadcasts, but it will not block incoming broadcast messages sent by other machines.

I hope you understand that these rules are only going to block incoming/outgoing broadcasts over your wireless interface (wlan0). If you want to block all broadcasts, regardless of interface, delete the -i wlan0.

I hope you understand that blocking forwarding of broadcast packets makes no sense. Broadcast packets are, well, broadcast to everyone on the local network. So if machine X on the local wireless network sends a broadcast packet, then all other machines on the same wireless network are going to see the broadcast packet, regardless of what firewall rules you put in place. The FORWARD rules (and the whole concept of preventing broadcast packets from "flowing through") your machine just doesn't make sense.

P.S. If none of the above work, try deleting -m state --state NEW, in case that is messing things up. Most likely this won't make a difference. However, I know I'm able to block incoming broadcasts in my ruleset, and my ruleset doesn't try to filter on connection state, so I know it should work if you leave out the -m state --state NEW; it should still work with that included, but I don't know that for certain.

Answer 3

iptables is wonderful when the schema is thoroughly thought out and optimised for the environment, but it requires serious intellectual effort to get right!

I think of it like this:

INPUT - to the box
FORWARD - around the box
OUTPUT - from the box

You appear to have subnetted Class A 10.* to a Class C 10.0.0.* I assume you want 10.0.0.255 broadcasts on eth0/eth1.

Therefore, to block just broadcasts on 10.0.0.255 to and from wlan0 and prevent them being forwarded:

$IPTABLES -A FORWARD -i wlan0 -d 10.0.0.255/32 -j DROP
$IPTABLES -A FORWARD -o wlan0 -d 10.0.0.255/32 -j DROP
$IPTABLES -A INPUT   -i wlan0 -d 10.0.0.255/32 -j DROP
$IPTABLES -A OUTPUT  -o wlan0 -d 10.0.0.255/32 -j DROP

To block the forwarding for 10.0.0.255/32 on all interfaces:

$IPTABLES -A FORWARD -d 10.0.0.255/32 -j DROP

This would still allow it to be used, but won't cross interfaces in any direction.

I would also add a lot more rules to stop spoofing, bogons, selected icmps and igmp and lock down exactly what addresses/ports get forwarded and blocked to/from each combination of interfaces, so that there is no chance of private addresses leaking to the net, or spoofed addresses getting in, or one hacked machine getting into other machines that it shouldn't.

My iptables ruleset is around 25,000 lines, but most of those are geoip rules to decide what countries can send mail at what times, as well as banned users, brute force attackers, known spamhaus offenders etc.

Maybe I'm paranoid, but as a system administrator it is required!

Answer 4

I believe the correct rule would be:

$IPTABLES -A OUTPUT  -d 10.0.0.0/24   -j DROP
$IPTABLES -A FORWARD  -d 10.0.0.0/24   -j DROP

I'm not sure why your rule doesn't match broadcast packages, but in other examples I've seen this format.

Also, an alternative way found here blocks packet based on packet type.