First install ferm
by running sudo apt-get install ferm
Use Tails' ferm.conf
as a base and removing Tails' restrictions on localhost connections (you can add these back if required but a lot of them are based around Tails specific accounts which won't exist on your stock debian), then you'd create a ruleset like this:
domain ip {
table filter {
chain INPUT {
policy DROP;
mod state state (ESTABLISHED) ACCEPT;
interface lo ACCEPT;
}
chain OUTPUT {
policy DROP;
mod state state (ESTABLISHED) ACCEPT;
outerface lo ACCEPT;
daddr (10.0.0.0/8 172.16.0.0/12 192.168.0.0/16) @subchain "lan" {
proto tcp dport domain REJECT;
proto udp dport domain REJECT;
ACCEPT;
}
mod owner uid-owner debian-tor {
proto tcp syn mod state state (NEW) ACCEPT;
}
LOG log-prefix "Dropped outbound packet: " log-level debug log-uid;
REJECT reject-with icmp-port-unreachable;
}
chain FORWARD {
policy DROP;
}
}
table nat {
chain PREROUTING {
policy ACCEPT;
}
chain POSTROUTING {
policy ACCEPT;
}
chain OUTPUT {
policy ACCEPT;
daddr 127.192.0.0/10 proto tcp REDIRECT to-ports 9040;
daddr 127.0.0.1 proto udp dport 53 REDIRECT to-ports 5353;
}
}
}
domain ip6 {
table filter {
chain INPUT {
policy DROP;
interface lo ACCEPT;
}
chain FORWARD {
policy DROP;
}
chain OUTPUT {
policy DROP;
outerface lo ACCEPT;
LOG log-prefix "Dropped outbound packet: " log-level debug log-uid;
REJECT reject-with icmp6-port-unreachable;
}
}
}
Save this file to /etc/ferm/ferm.conf
then issue sudo service ferm restart
.
You may also wish to review the LAN OUTPUT
section and further restrict this down to just DHCP traffic, for example from this:
daddr (10.0.0.0/8 172.16.0.0/12 192.168.0.0/16) @subchain "lan" {
proto tcp dport domain REJECT;
proto udp dport domain REJECT;
ACCEPT;
}
to this:
daddr (10.0.0.0/8 172.16.0.0/12 192.168.0.0/16) @subchain "lan" {
proto udp dport 67 sport 68 ACCEPT;
}
ferm.conf
from Tails as a basis. (ferm
is an iptables manager, it just lets you write more readable rulesets than rawiptables-save
dumps)sudo apt-get install ferm
also check that it's not got tails specific stuff in there (e.g. users that do not exist on your system). it will need modification to suite your environment.