Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently deploying on Rackspace Cloud Servers with Debian installs.

I have an application that uses a remote coordinator which communicates with all of my servers in order to start various services and just to generally keep track of the servers.

I need to secure my production environment and I'm using certain services (Couchbase/Membase and ElasticSearch) that don't have built in security so I need to implement a firewall on all of my servers. The coordinator can be modified to provide firewall rules for the servers to implement, but I don't know how to modify firewall settings in Debian programmatically. I would like to be able to specify ports just to lock it down a bit tighter.

If anyone has any advice on how to achieve this or can see that I'm doing something wrong then please let me know.

share|improve this question
up vote 0 down vote accepted

I think this is usually accomplished by using the iptables-restore tool, which simply loads iptables rules from a file. The coordinator then should just deploy a new version of the rules file (usually /etc/iptables.rules) and call iptables-restore to load it.

Do not forget to load the firewall on boot as well, by creating a if-pre-up.d script as described in .

share|improve this answer

In general you should start by configuring services to only listen on the localhost (lo) interface and not on any publicly routed interfaces (eth0). It's still a good idea to put firewall rules in place, though.

In some instances you want to be able to allow a configured service to listen on a publicly routed interface (e.g. eth0), but only allow connections from specific machines, like your remote coordinator. You could do that programmatically by IP address, but that can be inconvenient when you spin up new instances somewhere.

Instead of dealing with the hassle of maintaining IP-based firewall rules you could control the firewall rules with fwknop: Single Packet Authorization and Port Knocking. The default-drop packet filtering is low-overhead and works very simply without the complications of lesser port knocking systems. To install it for Debian:

sudo apt-get install fwknop-server fwknop-client
share|improve this answer

Consider running Shorewall-lite on the the servers, and controlling the firewall configuration from a central server running Shorewall. Both are available as Debian packages in the standard distribution.

The Shorewall configuration can be setup to use common files for shared configuration. This will help get consistent configuration across the servers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.