I'm setting up a firewall for devices that use DHCP, so their addresses can change over time. I want different devices on my local network to reach different services, but maintaining rules for individual IP addresses may be impractical. Is it reasonable to deny inbound traffic by default and allow connections from the local IPv4 network and IPv6 link-local addresses? I understand that restricting access to only the specific ports in use is more secure, but the required services can vary. What approach do you use?
5 Answers
If this is a server that should only accept inbound connections from your LAN, allow the relevant IPv4 and IPv6 network prefixes to access the specific service ports. You generally don’t need separate rules for every DHCP address. For outbound traffic, allowing established connections and normal outbound access is usually fine unless you specifically need egress filtering.
A practical setup is to use firewall zones tied to network interfaces, then apply stricter host-level rules for individual services. If your LAN is trusted, you might allow normal outbound traffic and limit inbound access per service. DHCP means you should base rules on network ranges, interfaces, or service ports rather than fixed device addresses.
There isn’t one universally ideal rule set. Start with the actual security objective: which services need inbound access, from which networks, and whether outbound connections need restrictions. A default-deny inbound policy is a good baseline, but blindly allowing an entire LAN can expose every service to any compromised device on that network.
Make sure a final deny rule doesn’t come before the allow rules, or you’ll block the traffic you intended to permit. In most firewall tools, the normal pattern is to allow loopback and established traffic, add the required network-and-port rules, and then deny or reject the remaining inbound traffic.
Don’t forget to allow loopback traffic. Many Linux services rely on the loopback interface, and blocking it can break otherwise unrelated functionality. Also, a LAN isn’t automatically trustworthy—devices can be compromised—so there are cases where internal traffic should be restricted just like external traffic.
That matches what I was trying to figure out. I’m also using a configuration based on common UFW defaults, with IPv6 link-local handling and forwarding enabled for virtual machines behind NAT.