Raspberry Pi Firewall
You have two good options for protecting your raspberry pi with a software firewall. The first is the tried and true iptables. The second is much more easy to use and configure, and that's debian's "ufw" service. I'll show you how to firewall your Raspberry Pi with ufw.
Before we start messing around with firewall rules, I always like to leave myself a backdoor. We're going to continually open up port 22 to our local network. We'll open up a screen session and start a loop. When we're sure everything is good, we'll close our screen session.
You can learn more about the awesome program screen
here.
$ apt-get install -y screen
$ screen -S firewall
$ while true; do ufw allow from 192.168.1.0/24; sleep 60;done
(disconnect from the screen session by type in "ctrl+a d")
Great, now we have a backdoor in case we lock ourselves out. Every 60 seconds our session will try allow every address from 192.168.1.1-255 to access every port on the host. You'll only be locked out for up to a minute. Trust me you do not want to skip this step.
We can use ufw to add different ports. Here's my basic setup.
# Allow port 22 to everyone in the world
sudo ufw allow 22
# Allow all ports on my local network
sudo ufw allow from 192.168.1.0/24
# Allow web ports to everyone
sudo ufw allow 80
sudo ufw --force enable
You can check the status:
$ ufw status
Status: active
To Action From
-- ------ ----
Anywhere ALLOW 192.168.0.0/24
Anywhere ALLOW 192.168.1.0/24
80 ALLOW Anywhere
22 ALLOW Anywhere
80 ALLOW Anywhere (v6)
22 ALLOW Anywhere (v6)
Now all of the Raspberry Pi's ports are exposed to our local network, but everything else can communicate with port 22 and 80. If you're done making changes to the firewall and are positive you're not locked out, then go ahead and kill the screen loop:
$ screen -r
(ctrl + d once inside the session)
Now you've got every port locked down from the outside but 22 and 80. But your raspberry pi probably isn't yet expose to the public internet. For this to happen we're going to add our Raspberry Pi to the DMZ on our wireless router's firewall.
A firewall DMZ means that every port will be forwarded to this specific host by default. This will make our raspberry pi the first port of entry into our home network. You can connect to it anywhere, and even use your raspberry pi as an
ssh tunnel.
You can usually find the dmz settings by logging into your router, which is typically found at 192.168.1.1 or 192.168.0.1.
 |
| DMZ Settings for Tomato wireless firmware |
Now you can run some external port scans and make sure the ports are actually open. You can use
inCloak's tool. Since we opened up every port to our local network, we'll need to use an external port scanner.
Here's the scan on my network, which has my Raspberry Pi in the DMZ.
Success. It looks like port 22 and 80 are open. Everything else is closed off. Now you can "safely" expose your raspberry pi to the public internet.
Up next: Protecting Your Raspberry Pi With fail2ban and SSH Private Keys
