Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up my first Lamp server on Debian Linux (Lenny). I'm a complete newb so please forgive my ignorance.

I'm trying to secure the server and have just removed all unneeded open ports using the netstat output. I've got it down to just 2 open ports which are http and mysql ports.

If i only have these two ports open does that mean they're the only two by which someone/something can launch an attack on my machine through? Do I need to set a firewall up if these are the only two open ports? Obviously in the future I will be needing to open other ports for stuff like ssh etc.


share|improve this question
up vote 5 down vote accepted
  1. do you really need to access remote mysql access? maybe you can limit it a bit or maybe mysql access over localhost/loopback is enough?

  2. did you limit OUTGOING connections? even if you will have some vulnerable software limiting outgoing connections will help you hinder downloading of potentially harmful payload.

suggested rules:

iptables -P INPUT DROP
iptables -P OUTPUT DROP

iptables -F
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s your.trusted.ip.address -j ACCEPT

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

when you need to run system updates:

iptables -I OUTPUT -j ACCEPT

when it's done:

iptables -D OUTPUT -j ACCEPT
share|improve this answer
I was unaware that the mysql one was for remote access. No I don't need that either in that case. I'm not sure how to make netstat output outgoing connections. I'm currently using netstat -plunt to show me the ports and the app using the port. Do i need a different command to show outgoing? – elduderino Jul 24 '10 at 19:45
well - you should know exactly what outgoing connections you allow. so - probably you want to allow those going to your dns server [for some dns/rev dns lookups], you probably would like to allow ftp/http connections to your debian update servers, maybe something to your smtp relay host... and not much more. obviously you want to allow established,related connections. – pQd Jul 24 '10 at 19:52
Ok great. So how do I get netstat to show outgoing connections? I can't seem to find details of what command I need to add to get it to show outgoing. Connections – elduderino Jul 24 '10 at 20:11
netstat -an should show them, alternatively just run tcpdump and analyze output. – pQd Jul 24 '10 at 20:30
ok.. refuse all incoming connections except http. allow all traffic via lo [loopback]. probably you also want to allow limited ssh connectivity; drop all outgoing connections except established, related. – pQd Jul 25 '10 at 16:44

It's something to consider.

Having a firewall in place either on that box or before it can be useful down the line. What if you want to ban an abusive user from your service? Instead of worrying about implementing that in your app, you can just do it with iptables. Same with SYN flood prevention.

What about bandwidth rate limiting? That could also come in handy down the road.

Finally, don't forget about some of the redirect tricks that you can pull off if you decide to put a proxy in between your users and your web server.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.