Linux Networking Cookbook

3.18. Writing Egress Rules

Problem

You prefer having an OUTPUT ACCEPT policy, and you want to add some egress filtering rules to block traffic destined for known bad ports from leaving your network. You also want to add some basic precautions, such as not allowing NetBIOS traffic or private addresses to escape your network.

Solution

Here are some example egress filter rules that go with an OUTPUT ACCEPT policy. You could add these to any of the firewall scripts in this chapter.

First, create variables containing your desired port numbers. EVILPORTS are port numbers known to be used by various malware. GOODPORTS are for preventing certain types of LAN traffic from escaping:

	EVILPORTS="587,666,777,778,1111,1218"
	GOODPORTS="23,137,138,139,177"

iptables doesn't seem to like lists longer than 15 port numbers.

Now, you can use these in rules like these examples:

	$ipt -A OUTPUT -i $LAN_IFACE -p --dport $EVILPORTS -j DROP
	$ipt -A OUTPUT -i $LAN_IFACE -p --dport $GOODPORTS -j DROP

Or, you can specify source addresses instead of the interface name:

	$ipt -A OUTPUT -s 192.168.2.0/24 -p all --dport $EVILPORTS -j DROP

The Discussion goes into more detail on what ports to block.

You can block specific addresses, or entire networks:

	$ipt -A OUTPUT -i $LAN_IFACE -p -d 11.22.33.44 -j DROP
	$ipt -A OUTPUT -i $LAN_IFACE -p -d 22.33.44.55/30 -j DROP

RFC 1918 addresses, and broadcast and multicast addresses should not leak out of your network:

 $ipt -A OUTPUT -s 10.0.0.0/8 -j DROP $ipt -A OUTPUT -s 172.16.0.0/12 ...