Firewall rules for ssh, ftp and webapps

Question

I'm running a small cluster with Centos 7 and want the following rules for firewall.

• Have ssh access from anywhere (i'm going to further configure that from /etc/ssh/sshd_config)
• Have ftp access to an ftp server
• Have access to a webapp running at :7180
• Have full access from some servers
• Log all events
• Prevent DDoS

I have written the following script but don't know if it's the optimal way. Any suggestions?

`#! /bin/bash

IPTABLES=/usr/sbin/iptables MY_NET=server1.sample.com,server2.sample.com,server3.sample.com MY_IP=123.456.789.101
FTP=ftp.sample.com

$IPTABLES -F

$IPTABLES -I INPUT 1 -j LOG
$IPTABLES -I OUTPUT 1 -j LOG

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP

$IPTABLES -A INPUT -p tcp -s $MY_NET,$MY_IP -j ACCEPT $IPTABLES -A OUTPUT -p tcp -d $MY_NET,$MY_IP -j ACCEPT

$FTP -m multiport --dports 20,21 -j ACCEPT $IPTABLES -A OUTPUT -p tcp -d $FTP -m multiport --dports 20,21 -j ACCEPT

$IPTABLES -A INPUT -p tcp -m multiport --dports 22,7180 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m multiport --sports 22,7180 -m state --state ESTABLISHED -j ACCEPT

$IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

$IPTABLES -A INPUT -p tcp --dport 22,8080,7180 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT`

Answer 1

• The best solution for firewall is forbid all and then make a holes.
• Make one chain for protocol
• Make rules structured not linear, it help to be faster in big load.
• For LOG use with limit too, beware full log disk partition.

Some example which not cover your example, but show way howto

$IPTABLES -n ftp
$IPTABLES -n ssh
$IPTABLES -n webapp
$IPTABLES -n icmp
$IPTABLES -P INPUT DROP

#first log (i think better log only good or only bad)
$IPTABLES -A INPUT -m limit --limit 25/minute -j LOG
#decide to which chain goto...
$IPTABLES -A INPUT -p tcp --port 7180 -j webapp
$IPTABLES -A INPUT -p icmp -j icmp
$IPTABLES -A INPUT -p tcp --dport 22 -j ssh

#fill chain specific for protocol (port was matched before)
$IPTABLES -A webapp -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A icmp -p icmp --icmp-type echo-reply -j ACCEPT
#ssh accept packet to all destionation.. it is quicker then state comparsion
$IPTABLES -A ssh -j ACCEPT 

#for output make other chain than input
$IPTABLES -N ssh_out
$IPTABLES -A OUTPUT -p tcp --sport 22 -j ACCEPT
$IPTABLES -A ssh_out -m state --state ESTABLISHED -j ssh_out
$IPTABLES -A ssh_out -j DROP #or make drop policy on output...

And so one...