Block Outgoing Traffic to Private Networks

Introduction

Recently I got an email from the network department of my provider, letting me know that they had indications that one of my servers was performing netscans on private networks. Certainly I had not initiated any netscan manually. Moreover I don’t have lots of things installed on my server, only a few docker containers. So, where was the problem? And more importantly, how to fix it?

After switching off a couple of containers, the problem went away. I then examined how these containers are configured, and found one that starts with the option --net=host. Most probably this one was the culprit. By default docker containers don’t have access to the network stack of the host, so they cannot launch a netscan on the private network where the host is located. But if they are started with --net=host their network is the same as that of the host.

Needless to say that I removed it. However the advice from the network team was to harden the firewall of the server in order to block any outgoing communications to their private networks. In this tutorial I show how I did it. My server is ubuntu-18.04 but I am sure that the same steps can be applied easily to other distros too.

Step 1 – Make sure that ufw is installed

For managing the firewall of the server I use ufw(uncomplicated firewall).

First make sure that it is installed:

Then configure it properly by allowing the ports of SSH, HTTP, HTTPS, etc. and enable it:

Step 2 – Block any communications to private networks

The private networks are:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16
• 100.64.0.0/10

It is quite easy to block outgoing communications to them with ufw:

Check the status of the firewall with ufw status and you will see something like this:

You may also check with iptables-save, and you should see something like this:

You can test it with ping, for example ping 172.16.5.204, and you should get something like this:

The ufw deny out (OUTPUT) rules from above only block outgoing communication for packets from the host itself. When using containers/virtualization with routing like LXD, traffic will not reach the OUTGOING netfilter table as it passes through FORWARDING.

Additional steps for containers/virtualization (LXD)

This should not affect existing routes.

Step 3 – Unblock (optional)

If for some reason you need to unblock one of these private networks, you can do it by deleting the corresponding ufw rule, like this:

Conclusion

Communication from your server to private networks is not allowed on many providers. Blocking these communications with a firewall is important especially if you don’t have full control over what you install on your server. Doing it with ufw is very easy.