Limit the guest-network (ports and speed)

[ZoRaC]

Hi!

I would like to limit the guestnetwork a bit and was hoping to get some input on how.

I want to limit what ports the clients on the guestnetwork may access (TCP 80/443/25/110/143 and UDP 53) - all others should be blocked.
I guess this could be accomplished by iptables, but I'm quite new at iptables and not quite sure how to do it...

Also, is it possible to limit the bandwith for the guestnetwork (either pr client or the network in total)?

Btw, running the newest Merlin on my 68U

 

[ZoRaC]

Nearly there!

I'm almost there now, after doing a lot of googleing and trying out different methods!

/jffs/scripts/firewall-start:

#!/bin/sh
/sbin/ifconfig wl0.1 192.168.200.1/24

# Rules for wl0.1
/usr/sbin/ebtables -t broute -I BROUTING -p ipv4 -i wl0.1 -j DROP
/usr/sbin/ebtables -t broute -I BROUTING -p arp -i wl0.1 -j DROP
/usr/sbin/iptables -I INPUT -i wl0.1 -j DROP
/usr/sbin/iptables -I INPUT -i wl0.1 -p udp --dport 53 -j ACCEPT
/usr/sbin/iptables -I INPUT -i wl0.1 -p tcp --dport 53 -j ACCEPT
/usr/sbin/iptables -I INPUT -i wl0.1 -p udp --dport 67:68 -j ACCEPT
/usr/sbin/iptables -I FORWARD -i wl0.1 -j DROP
/usr/sbin/iptables -I FORWARD -i wl0.1 -p tcp -m multiport --dports http,https,imap,smtp,pop3,sftp,ftp,imaps -j ACCEPT
/usr/sbin/iptables -I FORWARD -i wl0.1 -d 192.168.100.1/24 -j DROP

# Limit downloadspeed
tc qdisc add dev wl0.1 root handle 1: htb default 10
tc class add dev wl0.1 parent 1: classid 1:1 htb rate 100mbit ceil 100mbit
tc class add dev wl0.1 parent 1:1 classid 1:10 htb rate 10mbit ceil 10mbit
tc filter add dev wl0.1 protocol ip parent 1:0 prio 1 u32 match ip dst 0.0.0.0 flowid 1:10

/jffs/configs/dnsmasq.conf.add:

interface=wl0.1
dhcp-range=wl0.1,192.168.200.100,192.168.200.254,255.255.255.0,86400s
dhcp-option=wl0.1,3,192.168.200.1

The only thing missing is limiting the UPLOAD-SPEED - I've tried different things, but can't figure it out. Also, the "tc" for eth0 already contains other stuff, so I'm afraid of messing to much around with it.

Any ideas on how to limit the upload-speed?

 

[yelo3]

I'm interested in this topic.
Which bandwidth are you giving to the guest network with those commands?