Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I am running Ubuntu 10.04.

Here are the IPv4 firewall rules that I've been using now for a few months:

*filter

#Allow all loopback (lo0) traffic and drop all traffic to 127/8
#that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

#Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#Allow HTTP and HTTPS connections from anywhere (the normal ports
#for websites and SSL)
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#Allow SSH connections
#The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

#Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

These rules seem to have served me well. I'm only running an Apache web server, and only allow HTTP and HTTPS connections. I also allow my server to be pinged.

First question: Do you think these IPv4 are secure enough? Is there any further room for hardening?

Recently, I activated IPv6 on my server. Correspondingly, I created firewall rules for IPv6 that are exactly the same as the above, except that I changed

-A INPUT -d 127.0.0.0/8 -j REJECT

into

-A INPUT -d ::1 -j REJECT

and changed

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

into

-A INPUT -p icmpv6 -j ACCEPT

These new IPv6 rules seem to be working fine. But I'm not sure. IPv6 is a lot more complex, so I may well be overlooking something.

Question 2: Can these IPv6 rules be hardened further?

In case you're wondering, I have the above IPv4 and IPv6 rules in their two separate /etc/iptables.firewall.rules and /etc/ip6tables.firewall.rules files, and activate them at boot by using

iptables-restore < /etc/iptables.firewall.rules

and

ip6tables-restore < /etc/ip6tables.firewall.rules
share|improve this question

closed as not constructive by Zoredache, rnxrx, Adrian, EEAA, HopelessN00b Oct 26 '12 at 2:16

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

1 Answer

up vote 4 down vote accepted

For IPv6, you need rules to deal with the RH0 security issue. They should appear at the beginning of each table.

-A INPUT -m rt --rt-type 0 -j DROP
-A FORWARD -m rt --rt-type 0 -j DROP
-A OUTPUT -m rt --rt-type 0 -j DROP

Aside from that, it looks reasonable.

share|improve this answer
Should I put these lines below the "*filter" line and above the "#Allow all loopback" line? – AtomicFault Oct 23 '12 at 22:47
1  
Yes, exactly there. – Michael Hampton Oct 23 '12 at 23:06
Of note: RH0 processing is disabled in Linux 2.6.20.9 but other systems behind your firewall which receive routed packets may still be affected. – Steve-o Nov 26 '12 at 18:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.