What is the correct way to package network traffic rules?

[ericpruitt]

I have iptables rules configured on my system that I used to block traffic being sent by a particular group. I pair this with a sudoers rule consisting of:

Code: Select all

ALL ALL=(:no-networking) NOPASSWD:SETENV: ALL

so I can block network access for a program by running it as that group with something like:

Code: Select all

sudo -g no-networking COMMAND [ARGUMENT]...

I want to create a Debian package that includes the firewall rules to simplify installing them on other systems. What's the correct way to package network rules? Is there a way I can do that will still work regardless of whether the system uses raw iptables, ufw, firewalld, etc.?

[Aki]

Hello,

You are asking two different questions, indeed.

[..] I want to create a Debian package that includes the firewall rules to simplify installing them on other systems. What's the correct way to package network rules?

The distribution of configurations to managed computers is not necessarily done by distributing packages. It can be done by configuration packages, in any way.

Is there a way I can do that will still work regardless of whether the system uses raw iptables, ufw, firewalld, etc.?

There isn't a single program to rule them all. If none of them are installed, it can be done using iptables/netfilter.

[lindi]

Why are you trying to block network traffic here? I can think of many ways to bypass the blocking that you are using (for example "systemd-run --user curl https://ifconfig.me").

[ericpruitt]

Why are you trying to block network traffic here? I can think of many ways to bypass the blocking that you are using (for example "systemd-run --user curl https://ifconfig.me").

Yes, I realize there are ways to get around this including cron and atd to name a couple of other options. My use case is blocking network access to reduce casual telemetry and old software trying to make outgoing connections to internet services that no longer exist (which is a problem for some older commercial titles I run under Wine). It's NOT intended as protection against malicious software. That being said, iptables has the ability to block traffic using supplementary groups using "--suppl-group" which would reduce the number of avenues for making outgoing connections if the user in question was a member of the group being blocked.