3

I'm new to iptables, and i've been trying to put together a firewall which purpose is to protect a web server. The below rules are the ones i've put together so far, and i would like to hear if the rules makes sense - and wether i've left out anything essential?

In addition to port 80, i also need to have port 3306 (mysql) and 22 (ssh) open for external connections.

Any feedback is highly appreciated!

#!/bin/sh

# Clear all existing rules.
iptables -F

# ACCEPT connections for loopback network connection, 127.0.0.1.
iptables -A INPUT -i lo -j ACCEPT

# ALLOW established traffic
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# DROP packets that are NEW but does not have the SYN but set.
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# DROP fragmented packets, as there is no way to tell the source and destination ports of such a packet.
iptables -A INPUT -f -j DROP

# DROP packets with all tcp flags set (XMAS packets).
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# DROP packets with no tcp flags set (NULL packets).
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# ALLOW ssh traffic (and prevent against DoS attacks)
iptables -A INPUT -p tcp --dport ssh -m limit --limit 1/s  -j ACCEPT

# ALLOW http traffic (and prevent against DoS attacks)
iptables -A INPUT -p tcp --dport http -m limit --limit 5/s -j ACCEPT

# ALLOW mysql traffic (and prevent against DoS attacks)
iptables -A INPUT -p tcp --dport mysql -m limit --limit 25/s -j ACCEPT

# DROP any other traffic.
iptables -A INPUT -j DROP
Improve this question
0

6 Answers 6

Reset to default
2

Try shorewall which provides a reasonable firewall out of the box. Enable access from net for the services you want. There are example rule sets for one, two, and three interfaces. The documentation is good and it is actively maintained.

I expect you will want to limit which addresses can access MySQL which is easily done. You can also secure SSH with port knocking where the port is closed unless you have probed the another port recently.

Improve this answer
2
  • Thanks. I ended up installing shorewall on my server, and it seems to work fine. The server is running on the RackSpace Cloud, so i went for the example with two interfaces (RackSpace CloudServers have one external interface, and one service interface). I can see that the rules shorewall has created for me far exceeds what i would ever have been capable of creating. I'm crossing my fingers that it actually does work :-)
    – sbrattla
    Jun 1, 2010 at 19:46
  • Seconded for shorewall. I've used it and loved it for years.
    – R. S.
    Feb 1, 2013 at 21:09
1
  1. You really want to allow ICMP.
  2. 5/sec is probably not enough for HTTP
  3. I don't see a point in rules for XMAS/NULL packets
  4. Also don't see a reason for special NEW packets rule

ETA: 5. Having this kind of rate limits makes DoS attacks really simple. I just need to send 1 SYN packet per second to your server to deny YOU ssh access.

Improve this answer
3
  • unbeli: thanks! I'll make sure ping requests can pass the firewall, and i'll make sure to increase the HTTP a fair bit. With regard to XMAS/NULL packets, i just got the impression from quite a few sites that it was a good idea? Furthemore, the reason for the NEW rule is that it should be dropped if it is not a 'valid' tcp packet with the SYN bit set.
    – sbrattla
    Jun 1, 2010 at 9:41
  • 1
    Re: ICMP, It's not about ping, more about destination unreachable, source quench and other important ICMP messages. Re: XMAS, it does not hurt to have it, but it also does not help anything on a web server. Just makes your ruleset more complicated. Re NEW, you have DROP all at the end anyway, let it fall through.
    – unbeli
    Jun 1, 2010 at 9:48
  • Thanks. One other thing though. I read somewhere that it was a good idea to have a rule that DROPs all packets from outside that appears as they are sent from localhost. Is that something i should handle?
    – sbrattla
    Jun 1, 2010 at 9:52
0

I would think about using something like NARC to do your iptables rules configuration:

http://www.knowplace.org/pages/howtos/firewalling_with_netfilter_iptables/netfilter_automatic_rule_configurator.php

There are some sensible defaults already in place with this package which you should be able to trust.

Improve this answer
0

I use Webmin, it has a good starting ruleset.

http://www.webmin.com/

Improve this answer
1
  • Thanks for your suggestion. I've had a look at it, but as i'm trying to get better at linux i thought it was a good idea to get my hands a little bit more dirty than what Webmin gives me the opportunity to. It does take a little longer though withouth something like webmin.
    – sbrattla
    Jun 1, 2010 at 19:48
0

Filter for outgoing communication from server to internet is also important. Especially SMTP is recommended to allow only for one server.

I manage Mikrotik firewalls, and I'm used to do for example:

  • Drop incoming pakets from internet with destination adress from private range
  • Drop portscans (above 5port checks per second)
  • SSH to another port (obscurity, I know, but it works!:-) ) and limit source IPs
  • Drop broadcasts for router
  • Drop TCP RST

And few more. I would recommend to read this: http://wiki.mikrotik.com/wiki/Dmitry_on_firewalling Syntax of Mikrotik is straight forward and it contains good pointing for beginner.

Improve this answer
0

With respect to the XMAS packet.

Different scanners send different flavors of XMAS. Your ALL ALL rule, while it SHOULD match the canonical definition of the phrase XMAS packet, doesn't actually catch them as NMAP sends them.

http://techhelplist.com/index.php/tech-tutorials/43-linux-adventures/120-nmap-linux-iptables-xmas-packets

nmap -sX, which is supposed to be the XMAS scan, won't be caught by ALL ALL.

ALL ALL equates to FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG What NMAP sends equates to FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .