0

I have been hosting a couple of websites on my dedicated machine. The OS is CentOS 5.6. Until now, I have been turning iptables off since it jsut blocked all web traffic. However, I see that this is not good and that I should enable the firewall. Unforunately, I have no idea how to do that, so I am asking here what good rules for my server should be. I have of course a lot of traffic going in and out.

A few things I run on the server - DirectAdmin - Apache - php - mysql - ftp - dns - other directadmin tools (like mail, etc).

It is pretty much a preinstalled version of DirectAdmin 1.39.1.

3 Answers 3

1

You need to decide what ports you want to have open and then allow access on the proper protocol for that port. I'll give you an example to get you started:

To open SSH (the first thing that you want to do so that you don't lock yourself out) you can do

iptables -A INPUT -p tcp -s 0.0.0.0/0 --dport 22 -j ACCEPT

In this example -s means source. You can change 0.0.0.0/0 to an address or subnet that you want to allow the connection to originate from. This is normally a good idea to do on SSH but not on HTTP/HTTPS traffic, since you want everyone to be able to get there.

After that you want to change the default incoming policy to drop anything that doesn't match a rule.

iptables -A INPUT -j DROP

In case you're not familiar with what services run on what port, you should check out this wikipedia article.

1
  • specifying -s 0.0.0.0/0 is entirely redundant and in fact a bad idea, you should match on conntrack state to ensure that INVALID packets never reach the sshd daemon. not to mention that --dport ssh works too.
    – Olipro
    Sep 11, 2011 at 21:00
0

you should read the iptables man page and familiarise yourself with the command format in order to produce a decent rule table.

for starters you should perform conntrack state matching to ensure all traffic is part of a valid connection flow and drop everything else.

To really write good iptables rules, you must first understand what iptables enables you to do; the main thing you'll use is -m conntrack but it really depends on how you want to lock things down... it really does let you do anything; from rate-limiting ICMP to blocking rapid connections attempts.

0

Since you have Directadmin installed in your server, you can install CSF (ConfigServer Security & Firewall) which will include the plugin for Directadmin so that you can manage the firewall from inside your admin panel itself. It comes handy if you are not familiar with the iptable firewall and also a bunch of advanced options.

http://configserver.com/cp/csf.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .