Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am in the process of setting up my firewall using iptables. This is the first time I have ever attempted something like this.

So far I have the following rules:

# Clear any previous entries
--flush
--delete-chain

# Set the default policies for all three default chains
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT

# Enable use of the loopback interface
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

# Accept inbound TCP packets
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT

# Accept inbound UDP packets
-A INPUT -p udp --dport 123 -j ACCEPT

# Accept inbound ICMP messages
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

The ports I have open are 80 (http), 443 (https), 22 (ssh), 123 (ntp).

Any suggestions or improvements would be greatly appreciated.

share|improve this question

2 Answers 2

Looks good to me.

In my personal config the lines with the TCP ACCEPT statements are a bit more specific though:

-A INPUT -p tcp --dport 22 --syn -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 80 --syn -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 443 --syn -m state --state NEW -j ACCEPT

share|improve this answer

I'd change your ssh port to something higher, like 2223, and disable 22. Also don't forget 8080 (backup http port).

share|improve this answer
1  
If you don't use 8080, don't open it. –  wzzrd Jul 12 '11 at 7:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.