Protect the LAN and phone traffic

Choose one firewall owner

This worked ruleset is for a fresh, dedicated Ubuntu lab PC using the exact address plan in the planning chapter. It is not a ruleset for a home router, Docker host, production server or a PC already running UFW, firewalld or another firewall manager. Check first:

sudo ufw status
sudo nft list ruleset
ip -br address
ip route

Continue with this complete example only when UFW is inactive and there are no existing rules you need to preserve. Otherwise merge the same policy into your existing firewall with help from its documentation. The file below contains flush ruleset, which atomically replaces the PC's rules when loaded. Do not use it on a host with unrelated firewall rules.

Keep a local keyboard and screen available. Substitute your real interface names and management subnet before applying it. Do not enable IPv4 forwarding until the forward policy is in place.

The policy in plain English

1. Local core functions can talk through loopback.
2. Only the administrator LAN can reach SSH on the PC.
3. Only the known eNodeB address can reach MME SCTP 36412 and SGW-U UDP 2152 through the radio interface.
4. Phone-originated connections cannot reach the core itself, home/private destinations or other phones through this router.
5. Phones can make outbound Internet connections and receive their replies.
6. The base station is not given general Internet forwarding. Firmware, time and management access are added deliberately if needed.

Subscriber isolation inside a base station can also depend on radio features. Disable any local switching or bridging function that bypasses the core's isolation. Use a managed switch or physical separation to prevent an unauthorised device joining the radio Ethernet.

Create the dedicated lab firewall

Back up any existing file and save the following as /etc/nftables.conf with sudo nano. All the address values here are examples from the planning chapter.

#!/usr/sbin/nft -f
flush ruleset

table inet private_lte {
  set non_public_v4 {
    type ipv4_addr
    flags interval
    elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10,
      127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12,
      192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4 }
  }
  chain input {
    type filter hook input priority filter; policy drop;
    iifname "lo" accept
    iifname "ogstun" counter drop
    ip saddr 10.45.0.0/16 counter drop
    ct state invalid drop
    ct state established,related accept
    iifname "enp1s0" ip saddr 192.168.50.0/24 tcp dport 22 accept
    iifname "enp1s0" udp sport 67 udp dport 68 accept
    iifname "enp2s0" ip saddr 192.168.200.10 sctp dport 36412 accept
    iifname "enp2s0" ip saddr 192.168.200.10 udp dport 2152 accept
    ip protocol icmp accept
    meta l4proto ipv6-icmp accept
  }
  chain forward {
    type filter hook forward priority filter; policy drop;
    ct state invalid drop
    iifname "ogstun" ip daddr @non_public_v4 counter drop
    iifname "ogstun" oifname "enp1s0" ip saddr 10.45.0.0/16 counter accept
    iifname "enp1s0" oifname "ogstun" ip daddr 10.45.0.0/16 ct state established,related counter accept
  }
  chain output {
    type filter hook output priority filter; policy accept;
  }
}
table ip private_lte_nat {
  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;
    ip saddr 10.45.0.0/16 oifname "enp1s0" masquerade
  }
}

The rules intentionally do not open the subscriber WebUI, MongoDB, Diameter, PFCP, GTP-C or monitoring ports to the LAN. The WebUI is accessed through an SSH tunnel. A new network service needs its own reviewed rule. Upstream router port forwarding and UPnP are not needed for this local build.

Validate, load and make forwarding persistent

sudo nft -c -f /etc/nftables.conf
sudo nft -f /etc/nftables.conf
sudo systemctl enable nftables
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/90-private-lte-forwarding.conf
sudo sysctl -p /etc/sysctl.d/90-private-lte-forwarding.conf
sudo nft list ruleset
sysctl net.ipv4.ip_forward

The syntax check must succeed before loading the file. Expected forwarding value: 1. Start a second SSH session from your administrator computer to confirm it still works. Do not open the subscriber WebUI on 0.0.0.0 as a workaround if it is unreachable.

The NAT rule lets private phone addresses use the PC's router-facing address. Your home router may translate that address again. Double NAT is acceptable for this small outbound-data lab. It does not provide public inbound reachability or an operator public-address service.

The subnet blocklist covers the main local/private destinations in this example. If your management or hosted services use other address space, add those destinations before allowing subscribers. A public address assigned to a management service still needs explicit protection.

Prove the boundaries

After a phone connects, test that it can browse the Internet with Wi-Fi off. Then check that it cannot load the PC's management page, your home router's page or the eNodeB's page. Try a connection between two test subscribers if you have them; the lab's routed policy should reject it. Check the rule counters with sudo nft list table inet private_lte.

For the radio's web interface, browse to its private address from the core's local desktop or use a temporary SSH local forward from your administrator computer. Do not add a general routed bridge from the radio subnet to your home LAN. Vendor cloud management is not required just to use an external EPC, but the exact radio firmware determines which local functions remain available.

Source references: nftables reference and Ubuntu firewall guidance.