Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I want 1 front end server that will run haproxy, and the other 3 servers will be used for front-end web servers, db servers and a redis server.
So only 1 vps server needs to be exposed, and the other 3 need to communicate with each other etc.
Would you recommend I use iptables for this? Or something else?
iptables by itself can be fairly complex. I'd suggest using CSF: http://www.configserver.com/cp/csf.html . It's pretty straightforward to setup, and you can easily deny all traffic to your 'internal' machines with it.
You may use: ufw - Uncomplicated Firewall
https://help.ubuntu.com/8.04/serverguide/C/firewall.html
It is quite simple.
If all the virtuals have public IP addresses, then I would advise locking them down as far as possible - just allow SSH in, even if it's only from your IP. Then, just open up the ports needed between the virtual running haproxy and the other machines.
I'd recommend using iptables itself rather than anything else, because it's always good to know exactly what you're blocking and (more importantly) what you're allowing through.
