I'm configuring a host firewall for several devices and virtual machines on my local network. Their IPv4 addresses come from DHCP, so the addresses can change, and different devices need access to different services. I understand that the most restrictive approach is to deny everything by default and allow only the specific ports that are required, but the services and devices vary in my setup. Would it make sense to allow inbound traffic from my local IPv4 network and IPv6 link-local addresses while denying everything else? What policy do you use in a setup like this?
4 Answers
If the goal is to protect a server from inbound connections, allow the relevant local IPv4 and IPv6 network ranges only for the service ports that should be reachable. DHCP is not a problem as long as you allow the subnet or firewall zone rather than individual addresses. For outbound traffic, many setups allow everything unless there is a specific need for egress filtering. Also make sure forwarding is configured separately if the host is providing NAT or routing for virtual machines.
At minimum, allow loopback traffic and established or related connections. Blocking loopback can break a surprising number of Linux services. A common baseline is default-deny inbound, allow loopback, allow established connections, permit only the required service ports from the appropriate networks, and decide on outbound filtering separately.
A blanket allow for the entire LAN is convenient, but it is not automatically safer. Internal devices can also be compromised, so consider whether each service really needs to be reachable from every local device. IPv6 link-local addresses are only one category of local traffic; if you want normal IPv6 LAN access, you may also need to allow your actual local IPv6 prefix. The rules should follow your security goals rather than just the fact that traffic originates locally.
There isn’t one universal best rule set. A practical approach is to use network zones or interfaces as the broad policy, then use host-based rules to restrict inbound access per service. You might trust your LAN enough to allow outbound traffic and selected internal connections, while still limiting which services are exposed. If the LAN contains untrusted or compromised devices, treat it less like a trusted network and restrict internal traffic too.
That matches what I needed. I’m using a zone-based firewall configuration and added the IPv4 and IPv6 forwarding settings required for my NAT-based virtual machines.