Linux as intermediate gateway?

liken · 01-19-2018, 05:07 PM

Hello.

Unfortunately I have a router without firewall and I want to block p2p traffic from a LAN ip camera.

I have a Ubuntu Server in the LAN (1 NIC only) and my idea would be to configure this server as the camera gateway with firewall.

IP CAMERA -> UBUNTU INTERMEDIATE GATEWAY WITH FIREWALL --> ROUTER GATEWAY -->
IP:192.168.1.8 // IP:192.168.1.7 // IP:192.168.1.1
GW:192.168.1.7 // GW:192.168.1.1 //

So, basically Linux Server redirecting to real gateway router, but applying firewall rules previously.

Is this possible? How could it be done?

ferrari · 01-20-2018, 02:51 AM

You'll need two NICs to fulfil your ambition to use your Ubuntu server as a firewall...

https://killtacknine.com/building-an...rk-interfaces/

273 · 01-20-2018, 03:36 AM

It might be best to describe your setup in a little more detail. Your assertion that you have a router which opens a machine to the internet without filtering seems more than a little strange.

liken · 01-20-2018, 04:23 AM

Quote:

Originally Posted by 273

It might be best to describe your setup in a little more detail. Your assertion that you have a router which opens a machine to the internet without filtering seems more than a little strange.

Not strange. P2P IP Cameras connect automatically with an internet cloud server, so people do not need to configure routers or port forwarding. But this is a security hole and in fact I suspect somebody or a bot from China is controlling my camera through the insecure cloud. I use port forwarding so I don't need P2P and camera does not allow to disable it.

My Router is a usual router (Vodafone Vox UI) , you can configure NAT and port forwarding but there is nothing similar to iptables in order to block ports or connections started by LAN devices.

Quote:

Originally Posted by ferrari

You'll need two NICs to fulfil your ambition to use your Ubuntu server as a firewall...

https://killtacknine.com/building-an...rk-interfaces/

But I do not want to replace my router with a Linux PC and 2 NICs. Also, I do not want 2 networks or 2 subranges. My idea is to use the Linux Server as a filter to block outside connections to the cloud from the camera. So I configure the camera with gateway 192.168.1.7 (linux server pc) instead of 192.168.1.1 (router), and Linux PC working as a router LAN to LAN (Instead LAN to WAN).

ferrari · 01-20-2018, 04:42 AM

Thanks for the added detail. I can understand that you want to block particular outgoing traffic from the camera, but I still don't get how you plan to implement this on an Ubuntu machine with only one network interface. I would consider purchasing an enterprise router to manage outgoing traffic.

liken · 01-20-2018, 05:59 AM

Quote:

Originally Posted by ferrari

Thanks for the added detail. I can understand that you want to block particular outgoing traffic from the camera, but I still don't get how you plan to implement this on an Ubuntu machine with only one network interface. I would consider purchasing an enterprise router to manage outgoing traffic.

Well. I just found another alternative.

I configure the camera without a gateway (or a invalid gateway). So, Camera has not internet access and cannot start outgoing traffic. Then, I map a Linux PC port to the camera port, they are in the same LAN. After this point Linux PC is acting as if it were the camera, but only with an open or allowed port, so it is an effective firewall. Then I configure port forwarding in router pointing to Linux Server instead of Camera.

IPTABLES rules in Linux PC are:

iptables -t nat -A PREROUTING -p tcp --dport 8181 -j DNAT --to-destination IP_CAMERA:8181
iptables -t nat -A POSTROUTING -p tcp -d IP_CAMERA --dport 8181 -j SNAT --to-source IP_LINUX_PC

This is working. I can reach the camera from Internet through 8181 port forwarding, but P2P apps are not able to reach the camera.

273 · 01-20-2018, 07:59 AM

Quote:

Originally Posted by liken

Not strange. P2P IP Cameras connect automatically with an internet cloud server, so people do not need to configure routers or port forwarding. But this is a security hole and in fact I suspect somebody or a bot from China is controlling my camera through the insecure cloud. I use port forwarding so I don't need P2P and camera does not allow to disable it.

My Router is a usual router (Vodafone Vox UI) , you can configure NAT and port forwarding but there is nothing similar to iptables in order to block ports or connections started by LAN devices.

But I do not want to replace my router with a Linux PC and 2 NICs. Also, I do not want 2 networks or 2 subranges. My idea is to use the Linux Server as a filter to block outside connections to the cloud from the camera. So I configure the camera with gateway 192.168.1.7 (linux server pc) instead of 192.168.1.1 (router), and Linux PC working as a router LAN to LAN (Instead LAN to WAN).

Thank you for explaining and confirning that your router does not simply expose ports to the internet.
If you're worried about the webcam get a refund.
Or set up specific rules on your router that the webcam is not allowed toi "dial out".
The

vincix · 01-21-2018, 07:40 AM

So you configured two IPs on the same NIC of your Linux machine and the camera has an ip belonging to a subnet under the main subnet of your lan?

liken · 01-21-2018, 05:03 PM

Quote:

Originally Posted by vincix

So you configured two IPs on the same NIC of your Linux machine and the camera has an ip belonging to a subnet under the main subnet of your lan?

No. Linux PC, 1 NIC, 1 IP.

Linux PC doing network address translation (NAT) in same NIC, unique IP, in order to map or link a camera port to a local port (similar to tunnels with reverse SSH, but with iptables and NAT). So Camera can be disconnected from Internet (No configured Gateway) and it is only visible in local ethernet network. For all intents and purposes Linux PC has the port of the camera and any port forwarding in router is pointed to this PC.

ferrari · 01-21-2018, 06:34 PM

Yes, interesting use of NAT with a single interface/network.