How does "DROP all anywhere" in the FORWARD table not render my router useless?

M-Pixel

3/10/23, 6:33 PM

I recently learned about IPTables and IP routing in order to configure a single-board computer to isolate a particular machine from the rest of my network, while still permitting it to access the internet, among a few other rules.

I decided to use this new knowledge to enhance the security of my embedded media devices (and maybe prevent them from displaying ads and reporting telemetry). I had an old ASUS router with Merlin firmware in the closet, so I set that up and got SSH working.

Unlike my previous SBC-based firewall, which had a fresh install of Ubuntu and a blank slate in iptables, the ASUS router comes with several rules defined out of the box, and the FORWARD table has me a bit confused:

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere            state INVALID
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            ctstate DNAT
ACCEPT     all  --  anywhere             anywhere

From my understanding, this would prevent the router from working as it does. If the TV wanted initiate a request to Netflix, for example, the router should see that the packet came from NIC #2 and is destined for the WAN NIC - not for any internal process - and therefore should be put through the FORWARD table. The first rule shouldn't apply because the packet is new - there haven't been any replies yet to give it RELATED or ESTABLISHED status. The next rule... should drop it. So the packet doesn't reach Netflix and nothing happens.

In fact, this seems to me that it should prevent anything and everything that isn't a direct communication between the router itself (e.g. the admin interface). But that certainly isn't the case, as the attached devices are accessing the internet without issue. So, clearly there is something I'm missing. Do ASUS routers not use the FORWARD table? Or are the rules not evaluated top-to-bottom? Why doesn't the above FORWARD table prevent my router from functioning properly as a switch?

123

0 + 0

router

iptables

asus

Tero Kilkanen

3/10/23, 8:32 PM

Your IPTables rules listing are missing interface information for each rule. Most likely the DROP rules are for traffic that comes in via WAN interface. Please add output of `iptables -vL` to the question.

Ginnungagap

3/10/23, 9:13 PM

Are you sure the devices are doing IPv4?

M-Pixel

3/10/23, 9:14 PM

@TeroKilkanen That's exactly what's going on! I thought it was strange that it had multiple seemingly identical rules. From Ubuntu, I'm used to `iptables -S`, which displays the full command-line equivalent for each rule, but which the ASUS OS' version doesn't have. Feel free to post that as an answer.

Nikita Kipriyanov

3/17/23, 7:04 AM

The only guaranteed way to know the complete firewall configuration is `iptables-save`. It is not hard to find questions even in the ServerFault that arose solely from the fact the user used some variant of `iptables -L` to list rules instead of doing a proper dump with `iptables-save`. After the latter, they had seen the reality and the question disappeared.

Score:1

Server

Tero Kilkanen

3/10/23, 10:27 PM

Your IPTables rules listing are missing interface information for each rule. Most likely the DROP rules are for traffic that comes in via WAN interface.

iptables-save or iptables -S can be used to show the full commands that created the rules.

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How does "DROP all anywhere" in the FORWARD table not render my router useless?

TH: "DROP ทุกที่" ในตาราง FORWARD ไม่ทำให้เราเตอร์ของฉันไร้ประโยชน์ได้อย่างไร

RO: Cum „DROP all anywhere” din tabelul FORWARD nu face routerul meu inutil?

RU: Как «DROP allwhere» в таблице FORWARD не делает мой маршрутизатор бесполезным?

VI: Làm thế nào để "DROP allwhere" trong bảng FORWARD không khiến bộ định tuyến của tôi trở nên vô dụng?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.