Join Log in
Score:0
avatar Server

iptables: How to block UDP between devices on LAN-side of gateway (using dd-wrt firmware)

cn flag
Grumpy Curmudgeon

Goal: To block UDP traffic to devices on LAN-side of this gateway (using dd-wrt firmware), that communicate with internet and each other, to test specific communications applications running on each device.

Exceptions: allow the bare minimum UDP needed to support basic network operations for these devices to continue communicating (eg: via TCP) with internet and each other.

What I've tried so far: Added rules (via SSH session) on this router/gateway:

iptables -I FORWARD -p udp -j DROP 
iptables -I INPUT -p udp -j DROP

Observed (what's working well):

  • The rule iptables -I FORWARD -p udp -j DROP successfully blocks devices on LAN-side from communicating via UDP with devices on WAN-side, as verified by inability to communicate between these devices with utility ncat -u.

Observed (what's not working):

  • Devices on LAN-side can communicate with each other, using UDP:
    • On device-1 (on LAN-side): ncat -lvu # launch ncat listener using UDP on default port 31337
    • On device-2 (on LAN-side): ncat -vu <ip-addr-device-1> # launch ncat caller using UDP on default port 31337

Expectation (desired outcome):

  • ncat caller on device-2 unable to communicate using UDP to ncat listener on device-1.
  • ncat caller on device-2 able to communicate using TCP to ncat listener on device-1, by not using ncat param -u.

Additional info:

  • Using command iptables -I INPUT -p udp -j DROP impacts too much other communication, but used anyways, to demonstrate ineffectiveness of this rule in preventing UDP communicaiton between these two devices.
  • Using hardware: tp-link AC1750 (Archer C7 v5)
  • Using firmware: dd-wrt, with setting "Operating Mode = Gateway"
  • Devices behind gateway are UWP, iOS, Android. Examples given here using UWP (Windows 10) devices.
  • I've seen How do I block UDP while still allowing outbound UDP connections with iptables?, but doesn't appear effective in my case, as demonstrated by trying iptables -I INPUT -p udp -j DROP.
123
0 + 0
A.B avatar
cl flag
A.B
Check [ebtables](https://web.archive.org/web/20210902064033/https://ebtables.netfilter.org/) and if you insist on using the wrong tool, here's some rope to hang oneself: [br_netfilter](https://web.archive.org/web/20210529184120/http://ebtables.netfilter.org/documentation/bridge-nf.html) except it's [disabled](https://openwrt.org/docs/guide-user/firewall/firewall_components#kernel_tuning_via_sysctl) in OpenWRT so might be in DD-WRT too.
0
Reply
Ron Maupin avatar
us flag
Ron Maupin
Bridged traffic (same layer-2 domain) does not pass through a routers, so you cannot use a router to block the traffic. A switch or WAP is a layer-2 bridge.
0
Reply
Score:1
avatar Server
us flag
Tero Kilkanen

Most likely you cannot interfere with the LAN-to-LAN traffic. All devices that I know that run DD-WRT / OpenWRT have an integrated switch, that switches traffic directly between LAN devices on layer 2.

Only traffic that needs forwarding is passed to the router part (layer 3) of the system, where Netfilter can intercept the traffic.

You can try setting up a Linux box with multiple Ethernet adapters and then bridging those adapters together. Then you can use br_netfilter to force the L2 traffic go via Netfilter, allowing intercepting of the traffic.

0 + 0
cn flag
Grumpy Curmudgeon
This answer appears corroborated by comment from @ron-maupin, and both sound reasonable to me. To solve my problem: I'll put other devices behind different routers, which means rules in `FORWARD` table should be effective in blocking UDP between these devices.. Thanks!
1
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.