Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just installed Firestarter on my Debian server, because I want an easy-to-use tool to administer the firewall on this server. The plan is to restrict access to some ports (e.g. 8080) and I've thought that an inbound rule is the right choice.

Am I on the right way?

I've added an example rule, which restricts access to port 8080 to IP adress (will change later to the right one).

Inbound rule in Firestarter

Another problem is, that I don't know if I should also activate SSH access or if this is activated by default. I am a little bit scared, that if I don't allow access to it in Firestarter, that I will take access from myself. :)

share|improve this question
up vote 1 down vote accepted

First of all, yes, you are on the right track. It is somewhat unusual to use Firestarter on a a server, but it is definitely possible. You are further correct that inbound rules are what you use to limit what traffic can get into the server.

SSH is a bit of a tricky one, which depends on a few other things. If your server is hosted in a data center and all you have is SSH access, then obviously that port has to be open. At the same time you want maximum protection, and the usual solution for this is to use a private/public key pair (generated with ssl-keygen) and to disable password authentication. Make sure your key authentication works before you do that, otherwise you'll have locked yourself out.

OTOH, if you have physical access to the server and there's no need to use SSH to manage the server (and by the looks you even have a GUI running on it), then I'd say close the port. The fewer open ports you have, the smaller the risk of anybody hacking in.

If your server has got no other firewall, then by default all ports are open. You should be able to set the default policy in Firestarter to "REJECT", which will close all of them, except the ones you specify as open.

share|improve this answer
Hi, thanks for the nice answer. I have not so much experience with firewalling servers, but what kind of tool would you recommend instead of Firestarter. I know there are other tools like guarddog, but I think all these GUI tools are a matter of taste. But what is a more proper way for administer the firewall on a server? – High6 Jun 20 '11 at 14:28
All GUI tools for firewalls have one thing in common: they cannot utilize the full set of features available from the underlying real firewall, which on Linux boxes is usually iptables. Most of our firewalls have a shell script that powers them up and down as needed, and the script contains command line commands representing the rules. I would recommend to start out with a GUI tool, and then start reading about iptables. The man page is a good starting point. – wolfgangsz Jun 20 '11 at 14:56
I also just recognized that Firestarter uses iptables, which is nice. But yes, I think it's always a good way to really know what's going on under the hood. Thanks again. – High6 Jun 20 '11 at 15:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.