Question on packet filter using in and out interfaces

[Daniel Hartmeier]

On Mon, Jul 23, 2012 at 12:53:41PM +0200, Tonix (Antonio Nati) wrote:

> So, does that mean the OUT phase evaluation always occurs when IN phase 
> has been positive (packet should pass)?

Yes. You have to both allow a packet in on the first interface and out
on the second interface. If you forget/omit the second part, the packet
will get dropped (assuming a default block policy).

> I'm thinking to management of a lot of interfaces, where one is the WAN, 
> and others are DMZ and/or customers dedicated subnets.
> 
> I'd love to put basic protections on WAN input, and then permit all 
> other interfaces to define its own rules for packets coming/going 
> from/to the specific subnet.
> 
> According to what I understand of your explanation, each interface could 
> have its own IN rules, and if the IN rules of a specific INPUT interface 
> are successfull, the OUT rules of the 'outgoing' interface are then 
> evaluated.

Yes. Example: you want to prevent customers from talking to arbitrary
SMTP hosts (prevent spam by forcing the use of a spam filtering proxy).

You can block this with OUT rules on the WAN interface, i.e. by only
allowing the proxy's source address to connect to external hosts'
port 25.

Even if customers can add pass rules for their respective interfaces,
they cannot circumvent your OUT on WAN rules.

> This would be wonderful, as each interface could have both IN and OUT 
> rules which do not interphere with or break other interfaces rules. And 
> would permit to write the most of rules just once, according to each 
> interface needs.

Yes, that's the upside of filtering on both directions on all involved
interfaces :)

The downside is that you might have to add some redundancy in your
rules: even if a customer adds 'pass out on DMZ to port 80' you'll also
have to add 'pass out on WAN to port 80'. When a customer complains that
something isn't working, you'll have to check both his interface's rules
AND the WAN rules.

Daniel