Provider traffic policies by DNS names

[Waldz]

As as a provider I want to share my network
While blocking everything and whitelisting domains/services which I allow
While allowing everything and blacklisting domains/services which I block

Tasks:

• Install ipset utility
• Find commands needed for blocking block
• Enable/disable DNS firewall chain on provider start/stop Decouple Iptables utility from from kill switch feature #1602, Enable traffic blocking for Openvpn service #1632
• Whitelist DNS query results to DNS firewall Apply DNS policy rules for incoming consumer traffic #1733, Whitelist myst domains to provider firewall #1741
• Match DNS query results with TrustOracle rules Apply DNS policy rules for incoming consumer traffic #1733
• Add WireGuard firewall Enable traffic blocking while starting Wireguard service #1754

Resources:

• https://blog.ls20.com/securing-your-server-using-ipset-and-dynamic-blocklists/
• https://forums.gentoo.org/viewtopic-t-863121.html
• http://ipset.netfilter.org/iptables-extensions.man.html

1. Create custom chain, which can be turned on/off:

nslookup ipinfo.io

iptables -S PROVIDER_DNS_FIREWALL

iptables -N PROVIDER_DNS_FIREWALL
iptables -A PROVIDER_DNS_FIREWALL -i tun0 -d 216.239.32.21 -j ACCEPT
iptables -A PROVIDER_DNS_FIREWALL -i tun0 -d 216.239.34.21 -j ACCEPT
iptables -A PROVIDER_DNS_FIREWALL -i tun0 -d 216.239.36.21 -j ACCEPT
iptables -A PROVIDER_DNS_FIREWALL -i tun0 -d 216.239.38.21 -j ACCEPT
iptables -A PROVIDER_DNS_FIREWALL -i tun0 -j DROP

iptables -I INPUT -i tun0 -j PROVIDER_DNS_FIREWALL

2. Create set of IPs which are allowed:

nslookup ipinfo.io

ipset create dns-firewall hash:ip --netmask 24 --hashsize 64
ipset add dns-firewall 216.239.32.21
ipset add dns-firewall 216.239.34.21
ipset add dns-firewall 216.239.36.21
ipset add dns-firewall 216.239.38.21

ipset list dns-firewall

3. Block by this dynamic set of IPs:

iptables -A PROVIDER_DNS_FIREWALL -m set --match-set dns-firewall dst -j ACCEPT
iptables -A PROVIDER_DNS_FIREWALL -i tun0 -j DROP

iptables -I INPUT -i tun0 -j PROVIDER_DNS_FIREWALL

4. Allow all Mysterium services to custom chain

[Waldz]

# On provider
tcpdump -i tun0 -n

# On consumer
curl http://ipinfo.io/
16:16:15.658389 IP 10.8.0.3.37818 > any-in-2415.1e100.net.80: Flags [S], seq 4127944465, win 29200, options [mss 1358,sackOK,TS val 1983318 ecr 0,nop,wscale 7], length 0
16:16:15.669859 IP any-in-2415.1e100.net.80 > 10.8.0.3.37818: Flags [S.], seq 452878380, ack 4127944466, win 65535, options [mss 1460,wscale 2,eol], length 0

[Waldz]

Works! Researched commands:

nslookup ipinfo.io

ipset create dns-firewall hash:ip --netmask 24 --hashsize 64
ipset add dns-firewall 216.239.32.21
ipset add dns-firewall 216.239.34.21
ipset add dns-firewall 216.239.36.21
ipset add dns-firewall 216.239.38.21
ipset list dns-firewall

iptables -N PROVIDER_DNS_FIREWALL
iptables -A PROVIDER_DNS_FIREWALL -m set --match-set dns-firewall dst -j ACCEPT
iptables -A PROVIDER_DNS_FIREWALL -j DROP

iptables -I FORWARD -s 10.8.0.1/24 -j PROVIDER_DNS_FIREWALL