r/linuxadmin • u/worldarkplace • 12d ago

Firewall rule

Is the ideal rule to deny all and only allow everything from your local LAN(IPv4) and link-local(IPv6) network?

For my use case my devices use DHCP and I need that different IPs from my network to connect to different services.

I know the best is to only allow the ports you will use, but this can vary in my case.

What do you think/do?

8 Upvotes

83% Upvoted

7 comments sorted by

View all comments

3

u/SuccessDry7214 12d ago

I'm assuming you're referring to the your servers firewall here and you only want devices on your local ipv4 and ipv6 lan to connect inbound on the ports on that server. If this is right then yes you'd only want to allow your local lan CIDRs ( v4 and v6) access to the ports the services listen on.

For outbound access on that server, unless you want to egress filter you're probably just going to want to allow all outbound connections from your servers nics

1

u/worldarkplace 12d ago edited 12d ago

This is the most accurate thing I wanted to express.

Edit: actually I have something similar to the arch config of ufw, so I think it's solved. https://wiki.archlinux.org/title/Uncomplicated_Firewall I just add ipv6 link local and allow ipv4 and 6 forwarding for the VMs in NAT in the sysctl file