Firewall Rule to allow all outbound traffic help

mroz · Apr 6th 2019

Hi all

I am trying to set up my firewall on my OMV VM. I have set up a few inbound rules that all work fine. I cant seem to get a blanket out bound rule set up tho. I am trying to set a alow all rule on out bound.

Please see below for my rules.

Does this look correct ?

JohnStiles · Apr 7th 2019

Quote from mroz

Hi all

I am trying to set up my firewall on my OMV VM. I have set up a few inbound rules that all work fine. I cant seem to get a blanket out bound rule set up tho. I am trying to set a alow all rule on out bound.

Please see below for my rules.

Does this look correct ?

Display More

It should work if OUTPUT Chain is ACCEPT.
Optionally, you can -A OUTPUT -j ACCEPT but you already have it.
You can optionally add
-A OUTPUT -m conntrack --ctstate RELATED, ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

But what exactly is the problem? Outgoing traffic is blocked? Maybe vm is....

JohnStiles · Apr 7th 2019

Display Spoiler

Code

:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.0.14/32 -i enx001e0630caa8 -j ACCEPT
-A INPUT -s 192.168.0.10/32 -i enx001e0630caa8 -j ACCEPT
-A INPUT -s 192.168.0.1/32 -i enx001e0630caa8 -j ACCEPT
-A INPUT -s 9.9.9.9/32 -d 192.168.0.52/32 -i enx001e0630caa8 -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -s 9.9.9.9/32 -d 192.168.0.52/32 -i enx001e0630caa8 -p tcp -m tcp --dport 1124:1200 -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j DROP
-A INPUT -s 127.0.0.0/8 -i lo -j DROP
-A INPUT -p tcp -m tcp --dport 3389 -j DROP
-A INPUT -m state --state INVALID -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -f -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,PSH FIN,SYN,PSH -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,URG FIN,SYN,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST FIN,SYN,RST -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -i enx001e0630caa8 -j LOG
-A INPUT -j DROP
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -d 1.1.1.1/32 -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -d 1.1.1.1/32 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -d 8.8.8.8/32 -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -d 8.8.8.8/32 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -d 192.168.0.14/32 -j ACCEPT
-A OUTPUT -d 192.168.0.10/32 -j ACCEPT
-A OUTPUT -d 192.168.0.1/32 -j ACCEPT
-A OUTPUT -s 192.168.0.52/32 -p tcp -m tcp --dport 443 -m state --state NEW -m tcp -j ACCEPT
-A OUTPUT -s 192.168.0.52/32 -p tcp -m tcp --dport 80 -m state --state NEW -m tcp -j ACCEPT
-A OUTPUT -s 192.168.0.52/32 -p tcp -m tcp --dport 21 -m state --state NEW -m tcp -j ACCEPT
-A OUTPUT -s 192.168.0.52/32 -p udp -m udp --dport 123 -j ACCEPT
-A OUTPUT -s 192.168.0.52/32 -p icmp -j ACCEPT
-A OUTPUT -d 127.0.0.0/8 -j DROP
-A OUTPUT -j DROP

Display More

Display Spoiler

Firewall Rule to allow all outbound traffic help

Participate now!

Tags