Recommendations for sensible ruleset?

Hi all,
I finally changed all firewall defaults to blocked. It was an eye opening experience how many connections the devices in my net wanted. And while I did block quite a few I have trouble defining rules for allowing traffic.
For instance in the telefonica net the wifi calling apparently uses IPSEC to connect to the o2 net (AS6805). I don’t see a workable approach to include all ipv4 addresses in that asn in a firewall rule. Of course I could allow port 500 to all outgoing targets. But that seems too wide a rule. Am I missing something here? Or am I to paranoid?

You are much braver than I.
I have not changed my default to blocked.
In this post Jon uses ASN to make a firewall rule.

Your first option of opening port 500 to the users that need it.
I find nothing wrong with that.
You could limit it to 1 County within red.

1 Like

Thank you for the linked thread. The solution Jon applied there seems perfect - if one could use the match-set feature in the rules part on the WUI. I don’t want to modify the iptables directly.

The problem I see with opening port 500 might be negligible. But consider voip. The german carrier Deutsche Telekom (AS3320) apparently expects udp ports 1025-65535 open for RTP streams. As my phones are calling from green - yes I know, they should be isolated at least by vlan - I’d need to open the whole house instead of a couple of windows (ports). And since I can’t really specify all ipv4 addresses in that block as separate rules I’d open it to red. That more or less defeats the point of a firewall in my opinion. I did change the source part to the telephone ip though but I’m not particularly happy with such a rule.

Same points could be made for apple, amazon aws (tuya), microsoft (teams!), google etc. Still I’m pretty happy with forward blocking. And I strongly recommend that setting after you got a feeling for ipfire. It seems daunting at first. But since you can switch that behaviour instantly you could start slowly and add rules as you go.

This was a educational one for me.
About service groups
That is the way to go if you need multiple ports
to leave your LAN.

Thanks again. I already use the groups for port groups. I was looking into building groups for ASNs but that is a somewhat futile attempt. Especially as I‘m not sure how often the IP ranges belonging to an ASN change. And knowing me I probably will forget to manually update the list.

Another hurdle is the way you build host/network groups. You have to setup the single hosts/networks first and build the group afterwards. It might be a valid way but its to cumbersome for me. I mark your answer as a solution though.

1 Like


output looks like this:

[root@ipfireAPU ~] # ASN=1
[root@ipfireAPU ~] # location list-networks-by-as --format=ipset --family=ipv4 ${ASN} > "/etc/ipset/AS${ASN}.ipset"
[root@ipfireAPU ~] # cat /etc/ipset/AS${ASN}.ipset
create AS1v? hash:net family inet hashsize       64 maxelem 1048576 -exist
flush AS1v?
add AS1v?
add AS1v?
add AS1v?
add AS1v?
add AS1v?
add AS1v?
add AS1v?
[root@ipfireAPU ~] #