This is a fairly simple task really, once you get to know how
DHCP works, however, you must be a little bit cautious
with what you do let in and what you do not let in. First of all, we should know
that DHCP works over the UDP
protocol. Hence, this is the first thing to look for. Second, we should check
which interface we get and send the request from. For example, if our
eth0 interface is set up with
DHCP, we should not allow DHCP
requests on eth1. To make the rule a bit more specific,
we only allow the actual UDP ports used by
DHCP, which should be ports 67 and 68. These are the
criteria that we choose to match packets on, and that we allow. The rule would
now look like this:
$IPTABLES -I INPUT -i $LAN_IFACE -p udp --dport 67:68 --sport \
67:68 -j ACCEPT
Do note that we allow all traffic to and from UDP
port 67 and 68 now, however, this should not be such a huge problem since it
only allows requests from hosts doing the connection from port 67 or 68 as well.
This rule could, of course, be even more restrictive, but it should be enough to
actually accept all DHCP requests and updates without
opening up too large of holes. If you are concerned, this rule could of course
be made even more restrictive.
