Basic Firewall Rules
Configure and manage basic firewall rules using iptables, OpenWrt, and IPFire.
Project objective
Build the same default-deny firewall policy three ways — raw iptables on a Debian host, UCI rules on OpenWrt, and the IPFire web UI — to compare how the same underlying netfilter concepts are expressed across a bare-Linux, router-firmware, and dedicated-firewall-distro platform.
Core work
Each platform implemented the same policy: default-deny inbound, explicit allow rules for SSH (rate-limited) and HTTPS, and everything else logged and dropped.
# --- iptables (Debian host) ---
sudo iptables -F
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
-m limit --limit 4/min --limit-burst 4 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
sudo iptables -A INPUT -j LOG --log-prefix "IPT-DROP: "
sudo netfilter-persistent save
# --- OpenWrt (UCI) ---
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-HTTPS'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].dest_port='443'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
/etc/init.d/firewall restart
# --- Verification: run from a separate host against the firewalled target ---
nmap -Pn -p 22,80,443,3389 10.10.10.5On IPFire the equivalent policy was built through Firewall → Firewall Rules, adding an allow rule for HTTPS from the GREEN network and leaving the default deny-and-log behavior for everything else — functionally identical to the iptables ruleset, just expressed as a managed rule list with automatic logging rather than hand-written chain rules.
Nmap verification scan result per port (1 = open/allowed, 0 = filtered/dropped) — confirms the policy matches intent before moving on.
What to document
The write-up captures each platform's ruleset verbatim, the same verification scan run against all three, and a short comparison table of how "default deny + explicit allow + rate-limited SSH" is expressed differently in chain-based iptables syntax, OpenWrt's UCI abstraction, and IPFire's rule-list UI.