raspberryPi 4
Linux Pi 5.10.0-18-arm64 #1 SMP Debian 5.10.140-1
Installation Method Supervised
Iptables block adguard webui immediately after install
P.S. before hass already once it was installed /opt/AdGuardHome/AdGuardHome (i uninstall it)
iptables -S
iptables -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A INPUT -s 192.168.0.0/24 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -m comment --comment “---------” -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 8123 -m comment --comment HomeAssist -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 8765 -m comment --comment motioneye -j ACCEPT
-A INPUT -p tcp -m tcp --dport 45158 -j ACCEPT
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -o hassio -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o hassio -j DOCKER
-A FORWARD -i hassio ! -o hassio -j ACCEPT
-A FORWARD -i hassio -o hassio -j ACCEPT
-A DOCKER -d 172.30.32.6/32 ! -i hassio -o hassio -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i hassio ! -o hassio -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o hassio -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
entre in web ui Blocked by iptables
localPiIP:8123/hassio/ingress/a0d7b951_adguard
if i clear input rules then Access in web ui allowed
iptables -P INPUT ACCEPT
iptables -F INPUT (clear all rules in chain)
why?
And how put correct rules in iptables?
cat AdGuardHome.yaml
bind_host: 127.0.0.1
bind_port: 45158
beta_bind_port: 0
users: []
auth_attempts: 5
block_auth_min: 15
http_proxy: “”
language: “”
debug_pprof: false
web_session_ttl: 720
dns:
bind_hosts:
- 127.0.0.1
port: 53
statistics_interval: 1
querylog_enabled: true
querylog_file_enabled: true
querylog_interval: 2160h
querylog_size_memory: 1000
anonymize_client_ip: false
protection_enabled: true
blocking_mode: default
blocking_ipv4: “”
blocking_ipv6: “”
blocked_response_ttl: 10
parental_block_host: “”
safebrowsing_block_host: “”
ratelimit: 20
ratelimit_whitelist: []
refuse_any: true
upstream_dns: []
upstream_dns_file: “”
bootstrap_dns:
- 1.1.1.1:53
all_servers: false
fastest_addr: false
fastest_timeout: 1s
allowed_clients: []
disallowed_clients: []
blocked_hosts: []
trusted_proxies:
- 127.0.0.0/8
- ::1/128
cache_size: 4194304
cache_ttl_min: 0
cache_ttl_max: 0
cache_optimistic: false
bogus_nxdomain: []
aaaa_disabled: false
enable_dnssec: false
edns_client_subnet: false
max_goroutines: 300
handle_ddr: true
ipset: []
ipset_file: “”
filtering_enabled: true
filters_update_interval: 24
parental_enabled: false
safesearch_enabled: false
safebrowsing_enabled: false
safebrowsing_cache_size: 1048576
safesearch_cache_size: 1048576
parental_cache_size: 1048576
cache_time: 30
rewrites: []
blocked_services: []
upstream_timeout: 10s
private_networks: []
use_private_ptr_resolvers: true
local_ptr_upstreams: []
tls:
enabled: false
server_name: “”
force_https: false
port_https: 443
port_dns_over_tls: 853
port_dns_over_quic: 853
port_dnscrypt: 0
dnscrypt_config_file: “”
allow_unencrypted_doh: false
strict_sni_check: false
certificate_chain: “”
private_key: “”
certificate_path: “”
private_key_path: “”
filters:
- enabled: true
url: https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt
name: AdGuard DNS filter
id: 1 - enabled: false
url: https://adaway.org/hosts.txt
name: AdAway Default Blocklist
id: 2
whitelist_filters: []
user_rules: []
dhcp:
enabled: false
interface_name: “”
local_domain_name: lan
dhcpv4:
gateway_ip: “”
subnet_mask: “”
range_start: “”
range_end: “”
lease_duration: 86400
icmp_timeout_msec: 1000
options: []
dhcpv6:
range_start: “”
lease_duration: 86400
ra_slaac_only: false
ra_allow_slaac: false
clients:
runtime_sources:
whois: true
arp: true
rdns: false
dhcp: true
hosts: true
persistent: []
log_file: “”
log_max_backups: 0
log_max_size: 100
log_max_age: 3
log_compress: false
log_localtime: false
verbose: false
os:
group: “”
user: “”
rlimit_nofile: 0
schema_version: 14
Ip connections without iptables rules. Web UI Connect ESTABLISHED
(here not all lines only Established by accew web ui adguard)
lsof -i -P -n
python3 5552 root 14u IPv4 52280 0t0 TCP 172.30.32.1:41008->172.30.32.2:80 (ESTABLISHED)
python3 5552 root 23u IPv4 52281 0t0 TCP 172.30.32.1:41022->172.30.32.2:80 (ESTABLISHED)
python3 5552 root 24u IPv4 52282 0t0 TCP 172.30.32.1:41028->172.30.32.2:80 (ESTABLISHED)
python3 5552 root 37u IPv4 50946 0t0 TCP 172.30.32.1:41040->172.30.32.2:80 (ESTABLISHED)
python3 5552 root 38u IPv4 50947 0t0 TCP 172.30.32.1:41046->172.30.32.2:80 (ESTABLISHED)
python3 5552 root 39u IPv4 50948 0t0 TCP 172.30.32.1:41048->172.30.32.2:80 (ESTABLISHED)
python3 5552 root 40u IPv4 50956 0t0 TCP 172.30.32.1:8123->172.30.32.2:56060 (ESTABLISHED)
nginx 6377 root 10u IPv4 52287 0t0 TCP 172.30.32.1:63577->172.30.32.2:53716 (ESTABLISHED)
nginx 6377 root 11u IPv4 49915 0t0 TCP 172.30.32.1:63577->172.30.32.2:53722 (ESTABLISHED)
nginx 6377 root 12u IPv4 49928 0t0 TCP 172.30.32.1:63577->172.30.32.2:58896 (ESTABLISHED)
nginx 6377 root 13u IPv4 49931 0t0 TCP 172.30.32.1:63577->172.30.32.2:42206 (ESTABLISHED)
nginx 6377 root 14u IPv4 49933 0t0 TCP 172.30.32.1:63577->172.30.32.2:42218 (ESTABLISHED)
nginx 6377 root 15u IPv4 49935 0t0 TCP 172.30.32.1:63577->172.30.32.2:42222 (ESTABLISHED)
nginx 6377 root 10u IPv4 52287 0t0 TCP 172.30.32.1:63577->172.30.32.2:53716 (ESTABLISHED)
nginx 6377 root 11u IPv4 49915 0t0 TCP 172.30.32.1:63577->172.30.32.2:53722 (ESTABLISHED)
nginx 6377 root 12u IPv4 49928 0t0 TCP 172.30.32.1:63577->172.30.32.2:58896 (ESTABLISHED)
nginx 6377 root 13u IPv4 49931 0t0 TCP 172.30.32.1:63577->172.30.32.2:42206 (ESTABLISHED)
nginx 6377 root 14u IPv4 49933 0t0 TCP 172.30.32.1:63577->172.30.32.2:42218 (ESTABLISHED)
nginx 6377 root 15u IPv4 49935 0t0 TCP 172.30.32.1:63577->172.30.32.2:42222 (ESTABLISHED)