iSCSI on Debian/Ubuntu - Firewall Configuration

Option 1: Disable Filtering on Storage Interfaces (Recommended)

For dedicated storage networks, disable firewall filtering on storage interfaces to eliminate CPU overhead from packet inspection. This is important for high-throughput iSCSI storage.

Why disable filtering on storage interfaces:

• CPU overhead: Firewall packet inspection adds latency and consumes CPU cycles
• Performance impact: At high IOPS, filtering overhead becomes significant
• Network isolation: Dedicated storage VLANs provide security at the network layer
• Simplicity: No port rules to maintain for storage traffic

Using UFW (Ubuntu)

# Allow all traffic on storage interfaces (no filtering)
sudo ufw allow in on ens1f0
sudo ufw allow in on ens1f1

# Verify
sudo ufw status verbose

Using iptables (Debian)

# Accept all traffic on storage interfaces (no filtering)
sudo iptables -A INPUT -i ens1f0 -j ACCEPT
sudo iptables -A INPUT -i ens1f1 -j ACCEPT

# Save rules
sudo apt install iptables-persistent
sudo netfilter-persistent save

Using nftables (Debian 10+)

# Create nftables configuration with no filtering on storage interfaces
sudo tee /etc/nftables.conf > /dev/null <<'EOF'
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Allow established connections
        ct state established,related accept

        # Allow loopback
        iif lo accept

        # Allow all traffic on storage interfaces (no filtering)
        iifname "ens1f0" accept
        iifname "ens1f1" accept
    }
}
EOF

# Enable and start nftables
sudo systemctl enable nftables
sudo systemctl restart nftables

Option 2: Port Filtering (For Shared or Non-Isolated Networks)

Use port filtering only when storage interfaces share a network with other traffic or when additional host-level security is required by policy.

Using UFW (Ubuntu)

# Enable UFW
sudo ufw enable

# Allow iSCSI traffic from specific subnet
sudo ufw allow from 10.100.1.0/24 to any port 3260 proto tcp
sudo ufw allow from 10.100.2.0/24 to any port 3260 proto tcp

# Or allow on specific interface with port filtering
sudo ufw allow in on ens1f0 to any port 3260 proto tcp
sudo ufw allow in on ens1f1 to any port 3260 proto tcp

# Check status
sudo ufw status verbose

Using iptables (Debian)

# Allow iSCSI traffic with port filtering
sudo iptables -A INPUT -p tcp --dport 3260 -s 10.100.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3260 -s 10.100.2.0/24 -j ACCEPT

# Or allow on specific interface with port filtering
sudo iptables -A INPUT -i ens1f0 -p tcp --dport 3260 -j ACCEPT
sudo iptables -A INPUT -i ens1f1 -p tcp --dport 3260 -j ACCEPT

# Save rules
sudo apt install iptables-persistent
sudo netfilter-persistent save

Using nftables (Debian 10+)

# Create nftables configuration with port filtering
sudo tee /etc/nftables.conf > /dev/null <<'EOF'
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Allow established connections
        ct state established,related accept

        # Allow loopback
        iif lo accept

        # Allow iSCSI on storage interfaces (port filtering)
        iifname "ens1f0" tcp dport 3260 accept
        iifname "ens1f1" tcp dport 3260 accept
    }
}
EOF

# Enable and start nftables
sudo systemctl enable nftables
sudo systemctl restart nftables

# Verify
sudo nft list ruleset