I want 1 front end server that will run haproxy, and the other 3 servers will be used for front-end web servers, db servers and a redis server.

So only 1 vps server needs to be exposed, and the other 3 need to communicate with each other etc.

Would you recommend I use iptables for this? Or something else?

  • is there any other way? (all the others just 'compile' to a set of iptables)
    – Javier
    Dec 19, 2010 at 0:35

3 Answers 3


iptables by itself can be fairly complex. I'd suggest using CSF: http://www.configserver.com/cp/csf.html . It's pretty straightforward to setup, and you can easily deny all traffic to your 'internal' machines with it.


You may use: ufw - Uncomplicated Firewall


It is quite simple.


If all the virtuals have public IP addresses, then I would advise locking them down as far as possible - just allow SSH in, even if it's only from your IP. Then, just open up the ports needed between the virtual running haproxy and the other machines.

I'd recommend using iptables itself rather than anything else, because it's always good to know exactly what you're blocking and (more importantly) what you're allowing through.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .