If you want to filter raw sockets, like those used by DHCP, on the same machine as the receiving process, you will need to use ebtables instead of iptables to do the filtering. (You can use iptables and ebtables at the same time, and you should continue using iptables to filter anything except raw sockets.)
ebtables is the ethernet bridge firewall ruleset. Support for it is installed in the Ubuntu kernel by default, but you will need to install the following extra packages: bridge-utils ebtables.
ebtables can only filter ethernet bridge interfaces, not regular network interfaces. Therefore, to use it you will need to make a bridge interface containing just the network interface(s) you want to filter. Caution: by making a network interface into a bridge interface, you will lose the ability to manage it using the GUI Network Manager.
I assume that your bridge interface (henceforth, br0) will contain only one network interface (in this tutorial, eth1) and the network IP you will use is 192.168.0.1. Modify the instructions accordingly if you want a different configuration.
First, delete any configuration you may have in Network Manager for eth1. If you do not do this, Network Manager may attempt to "help" by restoring eth1's settings, thus breaking your manual setup.
Once that is done, add the following to /etc/network/interfaces:
Code:
auto br0
iface br0 inet static
address 192.168.0.1
netmask 255.255.255.0
pre-up ifconfig eth1 down
pre-up brctl addbr br0
pre-up brctl addif br0 eth1
pre-up ifconfig eth1 0.0.0.0
post-down ifconfig eth1 down
post-down ifconfig br0 down
post-down brctl delif br0 eth1
post-down brctl delbr br0
Restart all networking (Network Manager and networking). It might be easier to just reboot to make sure everything stuck. ifconfig should show br0 with 192.168.0.1 and eth1 with no IPv4 address. `route -n` should show the route for 192.168.0.0/24 through br0 and nothing through eth1.
In the case of dhcpd, you will need to modify /etc/default/isc-dhcp-server to reference br0 instead of eth1. Any other references to eth1 you may have in configuration files (other than /etc/network/interfaces and udev) will probably also need to be changed to br0. Restart any networking services so modified. (Note, br0 comes up later during boot than Network Manager-managed interfaces, so you may have to modify init scripts of some services to wait for it to come up.)
Now, you can list ebtables rules using:
Code:
sudo ebtables -t filter -L
Note that it's a default accept policy. This is probably what you want; let UFW/iptables do the heavy lifting for everything but raw sockets.
Now, add a rule to drop incoming DHCP requests:
Code:
sudo ebtables -t filter -A INPUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j DROP
Now list ebtables rules again and see that the INPUT chain has a rule to drop DHCP requests.
Since ebtables is not supported by default in Ubuntu, there are no fancy init scripts to restore ebtables rules on reboot. You will have to make your own, but it's a simple matter of executing the above line after the bridge interface comes up.
[SOLVED] How to determine how a packet gets through UFW?
Adv Reply
Packet gets through UFW despite DROP rule
Re: How to determine how a packet gets through UFW?
Bookmarks