Provider can access my local network?

Question

I recently talked with my ISP about many things, basically related to my (little) company security, this guy is a networking guru to me, but he did a strange thing that worries me. Basically I have a web development machine located in my LAN, that has no port forwarding (is not reachable from internet), but he could access a web server on it from outside of router's WAN interface somehow and wouldn't tell me how he did it. He just says it's normal for him, being my provider, to be able to port scan and access my computer's services (wtf?!?). He also said that there should be some rule I should add to my routing table that should prevent it, but he "doesn't remember" it's contents. Obviously guy likes to pry into others' matters, and while we're kind of buddies, I REALLY don't like it.

I have an old linux router-in-a-box there, based on iptables 1.2-something, and here are it's scripts (I cut out any port forwarding and deny rules for brevity). These were standard ones.

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    DROP       tcp  --  anywhere             anywhere           tcp 
Chain FORWARD (policy DROP)
num  target     prot opt source               destination         
1    TCPMSS     tcp  --  anywhere             anywhere           tcp flags:SYN,RST/SYN     TCPMSS clamp to PMTU          
//here follows a bunch of port forwarding rules and DENY rules I set,
//and line 60 looks kind of out of place, given line 61
60   ACCEPT     all  --  anywhere             anywhere           
61   ACCEPT     all  --  anywhere             anywhere           state RELATED,ESTABLISHED 
Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

So the question is threefold:

• how an ISP could have accessed port 80 on my machine without me forwarding it on the router?
• how can I prevent him or anyone else in that network from doing that
• please explain why there's line 60 and after it there's line 61, because from what I understand, if anything is allowed at line 60 then packets would already be allowed to pass without even reaching line 61

EDIT:

This is my setup, I think it's pretty standard:

ISP network -> their WiFi bridge -> Our router -> Our Network (with my DEV machine)

ISP should only be able to portscan our router. All they gave me was a plug to their WiFi bridge that's on our roof and an IP, router was bought separately.

Answer 1

I think that you have the answer to your question in the firewall rules. From your network diagram it's reasonable to expect that your ISP has access to the Wi-Fi bridge that they provide, so if a host is accessible from there, it's likely he can access it.

In your rules, as you mention rule 60 seems out of place. Rule 61 looks like a standard rule necessary to allow traffic relating to outbound connections from the internal network, but rule 60 seems from the information you've given to have all traffic forwarded across your router.

you're also right to say that usually firewall match one rule then stop matching on that chain, so the first accept rule would be hit and the second one 61 wouldn't be hit.

To test this what I'd do if I was you would be to connected a machine to the "outside" interface of your router, give it an IP address in whatever subnet is used there (assuming there's no DHCP in place) and then try connecting to a machine on your internal network. If you can then, it looks likely that that rule "60" is the issue.

However be very careful removing the rule as removing accept rules on production firewalls can have unexpected consequences (i.e. it was allowing traffic you actually want and when you remove it, the traffic stops flowing).

Answer 2

First, you need to enable verbose output from iptables. The rules that appear to be the same might be different, because they have an undisplayed option. For instance, one of them might only apply to the loopback interface.

You need to clarify exactly what happened, what is connected where, and what he supposedly accessed via which connection. A full network diagram with IP addresses might help clear it up.

1. Maybe your router is routing your private IP space. While not accessible over the Internet in general, your ISP could add a route to say "192.168.1.0/24" that goes via your router.
2. Was he at your office? Maybe he just connected from inside your office but said he was outside.
3. He may have just logged into your router and changed things.
4. Your router might have UPnP or something enabled which allowed him to add rules dynamically (unlikely if just iptables).
5. If he had access to your network, he could have sent out a packet from the IP of your webserver and source of port 80. A poor NAT implementation (probably not iptables) might then make a mapping to port 80 that allows IP in. (ICE and other hole-punching systems are really just a collection of techniques to try to exploit poorly-implemented NAT devices.)