[SOLVED] Iptables on a diskless client

Märk Owen · 09-13-2015, 06:37 AM

Hello,

After setting up a TFTP/PXE system in my network, I got a working diskless client and I'm trying to setup some iptables rules on it for basic security when it runs.

Problem is, iptables seems to cut all communications with the server and thus, the diskless client is frozen. Is it necessary to setup iptables in this situation? If so, can you help me find out which rules to add/remove?

Here are my current rules:

Code:

#!/bin/sh

iptables -F
iptables -X

ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -s 192.168.1.2 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

exit 0

192.168.1.2 is my server's ip, for indication. Thank you in advance.

wildwizard · 09-14-2015, 04:32 AM

You must put in an allow rule set for the NFS file server before you add any other rules or in your case apply a policy of drop.

Märk Owen · 09-14-2015, 09:28 AM

I changed my rules to this:

Code:

#!/bin/sh

iptables -F
iptables -X

ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP

iptables -A INPUT -s 192.168.1.2 -j ACCEPT
iptables -A FORWARD -s 192.168.1.2 -j ACCEPT
iptables -A FORWARD -d 192.168.1.2 -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

exit 0

It works in itself BUT, since my diskless client needs to load Xorg, it seems to hang there (The GUI, I still have access to the rest of the system). No idea why.

wildwizard · 09-14-2015, 04:06 PM

Haven't looked at what Xorg does on the network side for a while but you could turn the firewall off and while X is running you could use lsof to find out what it's doing. Then you could tweak your rules to match.

jefro · 09-15-2015, 02:46 PM

Exactly where is the disk image running from by the way? Is it totally in ram on the client?

Märk Owen · 09-16-2015, 01:01 PM

The system is on the TFTP/NFS server. This is my first installation of this type, I don't know if it's fully loaded into the client's ram (no other drive on the client).

jefro · 09-16-2015, 07:36 PM

Opps, that didn't matter. It is the iptables for either or both ipv4/6 to lan issue.

Märk Owen · 10-11-2015, 05:15 AM

I found the issue, I put the loopback interface rule BEFORE the DROP policies and it allowed X to work, so, problem solved. I'm posting the final iptables script for anyone who could need it in the future:

Code:

#!/bin/sh

iptables -F
iptables -X

ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP

iptables -A INPUT -s 192.168.1.2 -j ACCEPT
iptables -A FORWARD -s 192.168.1.2 -j ACCEPT
iptables -A FORWARD -d 192.168.1.2 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

exit 0

unSpawn · 10-11-2015, 05:23 AM

Quote:

Originally Posted by Märk Owen

I found the issue, I put the loopback interface rule BEFORE the DROP policies and it allowed X to work, so, problem solved. I'm posting the final iptables script for anyone who could need it in the future

Thanks for posting. Please mark thread "solved" as well.

Märk Owen · 10-11-2015, 11:27 AM

Yes, I tried to but it seems I'm not allowed to edit my original post because the EDIT button's missing.

unSpawn · 10-11-2015, 03:00 PM

No, doesn't require editing your OP: there should be a link "mark thread solved" below this threads top header to the right.