1
What I mean by ``directly communicate''
Does it ever need to receive packets with the gateway's IP address as the source IP address, or send packets with the gateway's IP address as the destination IP address?
(I would still allow ICMP request-echo, reply, no route to host, and time exceeded.)
My current setup
My physical Linux server is behind a router which handles DHCP (I don't use that with the server. Static IP configured at boot), some (basic) firewalling, and NAT. It's not live yet, so at the moment downtime isn't an issue.
Why I'm asking
As I was blocking access to local network addresses in iptables, I was about to put in exceptions (-j RETURN rules in the private network address filtering chains) for the gateway address, when I stopped and wondered whether that would actually be necessary.
I don't administer the router from the server, and I don't want any program on the system to be able to do that, or change my local IP or anything along those lines, so if I understand NAT correctly disallowing traffic to/from that IP shouldn't break anything.
But I'm not confident enough about my networking to say for sure, so I thought that, before I possibly messed something up (especially something subtle like a less secure but hard-to-notice configuration change), I thought I'd do a bit of crowdsourcing on the decision.
Explanation if this is a stupid question
This is the first publicly-accessible server I've ever deployed so I'm actively trying to form as many good habits- and as few bad- as possible...
...After the question has been answered, and the answer accepted, and everything to do with the question pretty well resolved, some idiot moves this to Superuser? My question wasn't "Does my desktop need to access the gateway?", it was "Does my server?", and the question was specifically motivated by security concerns- sigh... Whatever. This is the site that people recommend questions be moved when they feel smugly superior, and that's just the way things are. – Parthian Shot – 2014-07-13T02:55:05.807