Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want 1 front end server that will run haproxy, and the other 3 servers will be used for front-end web servers, db servers and a redis server.

So only 1 vps server needs to be exposed, and the other 3 need to communicate with each other etc.

Would you recommend I use iptables for this? Or something else?

share|improve this question
is there any other way? (all the others just 'compile' to a set of iptables) – Javier Dec 19 '10 at 0:35
up vote 1 down vote accepted

iptables by itself can be fairly complex. I'd suggest using CSF: . It's pretty straightforward to setup, and you can easily deny all traffic to your 'internal' machines with it.

share|improve this answer

You may use: ufw - Uncomplicated Firewall

It is quite simple.

share|improve this answer

If all the virtuals have public IP addresses, then I would advise locking them down as far as possible - just allow SSH in, even if it's only from your IP. Then, just open up the ports needed between the virtual running haproxy and the other machines.

I'd recommend using iptables itself rather than anything else, because it's always good to know exactly what you're blocking and (more importantly) what you're allowing through.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.