2

Im using Firehol on my PPP gateway and looking for a way to only allow a list of whitelisted client LAN ip's outbound internet traffic.

I have tried the commented out line, but that blocks all clients.

interface4 "${lan_interface}" lan
    policy accept

interface4 "${ppp_interface}" internet
    protection strong

    policy reject
    ### client all accept src "${LAN_HOSTS_WHITELIST}"
    client all accept

    server http accept
    server https accept
    server ssh accept src "${SSH_ACCESS}"
    server ping accept src "${ICMP_ACCESS}"
    server ident reject with tcp-reset

 router4 lan2internet inface "${lan_interface}" outface "${ppp_interface}"
    masquerade
    route all accept
Drewsdesign
  • 31

1 Answers1

1

I solved this by moving the whitelist hosts to the route

interface4 "${lan_interface}" lan
    policy accept

interface4 "${ppp_interface}" internet
    protection strong

    policy reject
    client all accept

    server http accept
    server https accept
    server ssh accept src "${SSH_ACCESS}"
    server ping accept src "${ICMP_ACCESS}"
    server ident reject with tcp-reset

 router4 lan2internet inface "${lan_interface}" outface "${ppp_interface}"
    masquerade
    route all accept src "${LAN_HOSTS_WHITELIST}"
Drewsdesign
  • 31