Managing Firewall for your system

Managing Firewall for your system

Managing Firewall for your system

Category: Template Information &nbsp

The system firewall is based on iptables. Please read about iptables at Netfilter page.

Make sure you are root while running commands below

In general your sytem firewall is configured like:

/etc/init.d/iptables status
Table: filter
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all — 0.0.0.0/0 0.0.0.0/0
2 syn_flood tcp — 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02
3 allow_icmp all — 0.0.0.0/0 0.0.0.0/0
4 syn_protect all — 0.0.0.0/0 0.0.0.0/0
5 ACCEPT all — 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
6 ACCEPT tcp — 0.0.0.0/0 0.0.0.0/0 tcp dpt:20 state NEW
7 ACCEPT tcp — 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEW

Chain FORWARD (policy DROP)
num target prot opt source destination
1 ACCEPT all — 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

Chain OUTPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all — 0.0.0.0/0 0.0.0.0/0
2 ACCEPT all — 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED

Chain allow_icmp (1 references)
num target prot opt source destination
1 ACCEPT icmp — 0.0.0.0/0 0.0.0.0/0 icmp type 8

Chain syn_flood (1 references)
num target prot opt source destination
1 RETURN all — 0.0.0.0/0 0.0.0.0/0 limit: avg 16/sec burst 32
2 DROP all — 0.0.0.0/0 0.0.0.0/0

Chain syn_protect (1 references)
num target prot opt source destination
1 DROP tcp — 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW

To allow access to HTTP (port 80/tcp) from any run:

 

iptables -A INPUT -p tcp --dport 80 -j ACCEPT -m state --state NEW

 

The same for HTTPS (port 443/tcp):

 

iptables -A INPUT -p tcp --dport 443 -j ACCEPT -m state --state NEW

 

To allow your service(s) access to HTTP (port 80/tcp) at 1.1.1.1 run:

 

iptables -A OUTPUT -p tcp --dport 80 -d 1.1.1.1 -j ACCEPT -m state --state NEW

 

To block all outgoing ESTABLISHED,RELATED requests run:

 

iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED

 

To store rules run:

 

service iptables save

 

To check/show the status:

 

/etc/init.d/iptables status

    • Related Articles

    • Install ConfigServer Firewall On A cPanel Server

      ConfigServer Firewall (CSF) is a popular Linux firewall security suite. It is easy to install, flexible to configure and secure with extra checks. CSF helps control exactly how much traffic is allowed in and out of the server to protect the server ...

    • Managing VPS Labels and Backups

      Managing VPS Labels and Backups Category: Cloud Servers, VPS.net dashboard, VPS.net features &nbsp You may wish to edit the details of your VPS for many reasons, for example you may have forgotten to enable backups when creating it or the purpose of ...

    • How to run manual file system check

      How to run manual file system check Category: Cloud Servers, Recovery Interface, VPS.net dashboard, VPS.net features &nbsp If server is not coming up after “Startup” button is pressed, and you see one of the following messages in server console in ...

    • Device name change issues after system upgrade

      Device name change issues after system upgrade Category: OS related issues, Other services, VPS.net dashboard, VPS.net features &nbsp If server does not boot up correctly and manual file system check as described in the article here: ...

    • A definition of SSH port knocking for beginners

      A definition of SSH port knocking for beginners Category: Networking &nbsp Knock, knock. Who’s there? Reading about port knocking can be as clear as diving headfirst into a bog whilst wearing a snorkel. Some people love it, but for most of us, it ...