Only allow packets match interface ip using IPTables

Question

I have multiple wan port and multiple routing table in a box. The wan port should be the final destination of outside word. (eg: all the packets come from internet should have destination IPAddress of my wan port, there are no further routing beyond the wan IPAddress).

rp_filter seems not work correctly under multiple routing table situation, so I need to set rp_filter to 0.

I want to know if there are simple setup method to secure the wan port ? or I need to use iptables to drop the incoming packet not matching the wan interface IP?

The problem is I have dynamic PPP interface, so matching the ip via iptables is a little complicated. so I want to know if there are smarter ways to do the job.

Answer 1

1) You are talking about two different things. rp_filter checks the source address in incoming packets, not the destination address. Besides, receiving on an interface packets which are destined to the address of another interface is rather unlikely.

2) You can use scripts in /etc/ppp/ip-{up|down}.d to add|remove iptables rules based on the local address and interface name passed by pppd when a PPP link is established|terminated.
Simple example :

#!/bin/sh
# /etc/ppp/ip-up.d/addrules

# Environment variables :
# Variable Name Example
# PPP_IFACE Interface name ppp0
# PPP_TTY The tty ttyS1
# PPP_SPEED The link speed 38400
# PPP_LOCAL Local IP number 12.34.56.78
# PPP_REMOTE Peer IP number 12.34.56.99
# PPP_IPPARAM Optional "ipparam" value foo

iptables -I INPUT -i $PPP_IFACE ! -d $PPP_LOCAL -j DROP

#!/bin/sh
# /etc/ppp/ip-up.d/delrules

# Environment variables :
# Variable Name Example
# PPP_IFACE Interface name ppp0
# PPP_TTY The tty ttyS1
# PPP_SPEED The link speed 38400
# PPP_LOCAL Local IP number 12.34.56.78
# PPP_REMOTE Peer IP number 12.34.56.99
# PPP_IPPARAM Optional "ipparam" value foo

iptables -D INPUT -i $PPP_IFACE ! -d $PPP_LOCAL -j DROP