IPtables protection

[sikksakk]

Hi,
would it be an idea to add some IPtables rules so we can protect the container?
i have disabled NAT firewall on giganews to be connectable - but that also exposes my whole container on the public internet including an open unprotected transmission webinterface :-)

Could be a few simple rules on the tap interfaces, with configurable port range?
like:

iptables -F
iptables -A INPUT -i tun+ -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i tun+ -p tcp --dport 6881:6999 -j ACCEPT
iptables -A INPUT -i tun+ -p udp --dport 6881:6999 -j ACCEPT
iptables -A INPUT -i tun+ -j DROP

[pkishino]

@haugene @sikksakk I’m not great with iptables but that looks reasonable to me to add to dev branch for now?

[sikksakk]

@pkishino
that sounds great, I guess you can get the "peer-port" as --dport param, or if the "peer-port-random-on-start" is true put in "peer-port-random-low":"peer-port-random-high" from the transmission settings.json

i'm manually using these rules now on the container, and works as expected :-)