In a different thread, I shared my configs hoping to solve a DNS config problem (which was solved), and user anav kindly shared some insights, one of which was:
Firewall rules suck for a public facing IP… not safe, remove from internet.
I’m attaching my firewall configurations below because this is making me quite nervous.
why deleting the defconf firewal-rules when apparently not really understanding how ROS (“iptables”) firewall works essentially?
if not building smth sophisticated or speacial-purposed, take the default FW configuration from routerboard factory configuration and build up from there
I hope this has me covered. I wonder how much damage the lack of the input rule could have done in a few hours. Because I see it dropping some traffic..
If not actually using IPV6, what I recommend, is disabling it and removing all the associated firewall address lists and rules save add chain=input action=drop
add chain=forward action=drop
Yes, the firewall default filter rules are safe out of the box.
They are basically designed to block the worst traffic and then allow everything else.
An example would be in the input chain to block all traffic to the router except LAN traffic.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Once one makes changes to the default config, its usually best to turn the concept block the known bad things and allow everything else
TO
Block everything and allow only the known good things (aka needed traffic).
I think you can agree with me that its much easier to identify the needed traffic then to know about all the possible bad things that could be passing…
Thus, for example on the forward chain we take this default rule. add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
Which does the job as default but can be very confusing to the new person because its trying to do many things at once.
The take away is that this is the only real controlling/limiting rule in the forward chain and it says, DROP any traffic coming from the external www that is not coming in due to port forwarding.
In other words, it identifies potential bad trafficto block and then basically allows ANY other traffic to occur.
and change it to something that is clearer ( inferred that lan to wan traffic is allowed, now becomes OBVIOUS )
add chain=forward action=accept comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add chain=forward action=accept comment=“port forwarding” connection-nat-state=dstnat { disable or remove if not required }
add chain=forward action=drop comment=“drop all else”
Right away its clear to the reader the purpose of these rules, allow traffic to the www, allow any port forwarding, and then drop all other possible traffic, whatever it is!!!