r/linuxadmin • u/worldarkplace • 12d ago

Firewall rule

Is the ideal rule to deny all and only allow everything from your local LAN(IPv4) and link-local(IPv6) network?

For my use case my devices use DHCP and I need that different IPs from my network to connect to different services.

I know the best is to only allow the ports you will use, but this can vary in my case.

What do you think/do?

8 Upvotes

83% Upvoted

6 comments sorted by

3

u/SuccessDry7214 12d ago

I'm assuming you're referring to the your servers firewall here and you only want devices on your local ipv4 and ipv6 lan to connect inbound on the ports on that server. If this is right then yes you'd only want to allow your local lan CIDRs ( v4 and v6) access to the ports the services listen on.

For outbound access on that server, unless you want to egress filter you're probably just going to want to allow all outbound connections from your servers nics

1

u/worldarkplace 12d ago edited 12d ago

This is the most accurate thing I wanted to express.

Edit: actually I have something similar to the arch config of ufw, so I think it's solved. https://wiki.archlinux.org/title/Uncomplicated_Firewall I just add ipv6 link local and allow ipv4 and 6 forwarding for the VMs in NAT in the sysctl file

2

u/DialecticEnjoyer 12d ago

I think What youre asking is a stateless vs stateful firewall. I run firewalld with zones and interfaces as the basis for traffic. Since I trust my lan I allow all out and use hbf (host based firewalls) on the linux systems behind it to fine tune inbound traffic per service.

2

u/IOI-65536 12d ago

I'll note to start with you almost certainly want to allow loopback. A ton of Linux stuff uses loopback and iptables will let you deny it and break everything.

But to your general question there is no such thing as a best practice firewall rule. It's entirely dependent on your use case. There are reasons to block stuff even within the local network and there are reasons to allow stuff from outside of the local network. I can honestly imagine a situation where you're more concerned with the stuff on your local network than stuff on other networks because it's a hetrogenous DMZ and you have hardware firewalls to protect from other stuff but the host based firewall is all you've got against someone who took over an east-west machine.

2

u/stufforstuff 11d ago

Just remember, "deny all" needs to be your LAST RULE or you'll end up blocking yourself from your own computer.

0

u/michaelpaoli 12d ago

Is the ideal rule to deny all and only allow everything from your local LAN(IPv4) and link-local(IPv6) network?

Not generally, and you may quite break things that way. Maybe first start by figuring out what your objectives are. If you want the utmost in fierwalls, get rid of all manner of networking - entirely remove that attack surface, and then you're highly well protected from those attacks.