Why do I need that

I have a server on a large company network running new version of jenkins. I've migrated all the jobs (>600) over to a new server. Those jobs connect to different servers across our network. After starting jenkins some jobs will run overriding artifacts, pushing docker images to internal registries and so on. To prevent that without going into all 600 jobs and disabling then, I wish to disable local network access from the server. The network admins said that they don't want to mess with the firewall rules in fear they'll disable access to some important servers. So its on me to implement on the server side using iptables.

What do I need

What do I wish to do is to disable LAN access except one ip, and enable internet access. In more detail it goes like this.

Allow access to the server for ssh on port 22 and jenkins on port 8080 (I'm located on a different subnet than the server)

Allow access to the internet for plugin install and external build dependencies.

Drop anything going from the server to the local network 10.0.0.0/8. The server is located on 10.x.x.x/24 and it has access to different subnets over the router on 10.x.x.1

What have I tried

Final try before giving up. Didn't do anything.

#my ip 
iptables -j ACCEPT -s 10.x.x.x -i ens160 -A IN_public
iptables -j ACCEPT -d 10.x.x.x -o ens160 -A OUTPUT_direct

#subnet
iptables -j DROP -d 10.0.0.0/8 -o ens160 -A OUTPUT_direct

Some important notes before I'll provide the ruleset:

• 
  

  Avoid the modification firewall by scripts. Best flow:

  
  
  
  1. Save the current rule set with command iptables-save > fwrules.v4
     
  
  
  2. Edit the rules
  
  
  3. Test the rules with command iptables-restore -t fwrules.v4
     
  
  
  4. Safety apply the rules with command iptables-apply -t <timeout> fwrules.v4. Where <timeout> is timeout of confirmation in seconds. If you don't confirm the new rule set, it will rollback to the previous set.
  
  



• I guess the server has single network interface.



• Rule set itself:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# allow reply packets
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# allow incoming ICMP like ping and other
-A INPUT -p icmp -j ACCEPT

# allow to ssh and to jenkins from anywhere
-A INPUT -m conntrack --ctstate NEW -p tcp -m multiport --dports 22,8080 -j ACCEPT

# allow localhost connections
-A INPUT -i lo -j ACCEPT

# allow output packets to trust host
-A OUTPUT --dst 10.0.0.12 -j ACCEPT

# block output packets to other lan hosts
-A OUTPUT --dst 10.0.0.0/8 -j REJECT

COMMIT

• What's about DNS servers addresses? You should allow it too if they are in the local subnet.


• The order of rules is very important.