Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two LAMP servers, one with Ubuntu 9.10 the other with Ubuntu 8.04. Can someone recommend firewall software for them? I was following the guide at http://library.linode.com/networking/arno-iptables-firewall-debian-lenny, but ran into errors:

/sbin/iptables: (1) iptables: No chain/target/match by that name.

I'd like to allow ports 22, 25, 80, 443, 993, 995 and 10000.

If you can also suggest a step by step guide to install the firewall too, that would be great

share|improve this question
    
You must be getting that error for a certain firewall rule. I suggest you to attach the firewall rule to your question. –  Anonymous Feb 25 '10 at 7:29
    
One important gotcha: In most cases, when you install a firewall on a remote server, you get yourself locked out of SSH in the process. Luckily Linode has a recovery shell for just that case -- use it to add permit rules for SSH in your firewall. –  Jesper Mortensen Feb 28 '10 at 13:12

3 Answers 3

up vote 4 down vote accepted

On my server (which, coincidentally to your link, is a Linode), I use a program called UFW as a pretty frontend to IPTables. It's as easy as sudo aptitude install ufw on both your Ubuntu installs (it's part of the core repository, at least on 9.10 Karmic). I think this thread on the Ubuntu Forums should help quite a bit.

share|improve this answer

Another option which also simplifies the iptables rule and policy process is shorewall, more info.

share|improve this answer

+1 of UFW and Shorewall for more complicated uses. One thing more, if you enable a firewall, then you should really look at protecting yourself against brute-force login attempts to SSH. Motivation:

  • The brute force attempt clutter up your logs so that you might miss a serious hack attempt in the noise.
  • If your password is weak (it should not be) then a stupid brute-force hacker could get lucky.

One super-simple way of doing this is to use your firewall to limit SSH to connections where the source IP address is from your office / home ADSL / your other semi-trusted networks. A more flexible way is to do connection rate limiting, either with your firewall or with other deamons.

share|improve this answer
    
Can you do rate limiting with ufw or apt? Or, should I go with something like fail2ban? –  Trent Scott Apr 3 '12 at 2:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.