0

I'm running a small cluster with Centos 7 and want the following rules for firewall.

  • Have ssh access from anywhere (i'm going to further configure that from /etc/ssh/sshd_config)
  • Have ftp access to an ftp server
  • Have access to a webapp running at :7180
  • Have full access from some servers
  • Log all events
  • Prevent DDoS

I have written the following script but don't know if it's the optimal way. Any suggestions?

`#! /bin/bash

IPTABLES=/usr/sbin/iptables MY_NET=server1.sample.com,server2.sample.com,server3.sample.com MY_IP=123.456.789.101
FTP=ftp.sample.com

$IPTABLES -F

$IPTABLES -I INPUT 1 -j LOG
$IPTABLES -I OUTPUT 1 -j LOG

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP

$IPTABLES -A INPUT -p tcp -s $MY_NET,$MY_IP -j ACCEPT $IPTABLES -A OUTPUT -p tcp -d $MY_NET,$MY_IP -j ACCEPT

$FTP -m multiport --dports 20,21 -j ACCEPT $IPTABLES -A OUTPUT -p tcp -d $FTP -m multiport --dports 20,21 -j ACCEPT

$IPTABLES -A INPUT -p tcp -m multiport --dports 22,7180 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m multiport --sports 22,7180 -m state --state ESTABLISHED -j ACCEPT

$IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

$IPTABLES -A INPUT -p tcp --dport 22,8080,7180 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT`

1
  • The best solution for firewall is forbid all and then make a holes.
  • Make one chain for protocol
  • Make rules structured not linear, it help to be faster in big load.
  • For LOG use with limit too, beware full log disk partition.

Some example which not cover your example, but show way howto

$IPTABLES -n ftp
$IPTABLES -n ssh
$IPTABLES -n webapp
$IPTABLES -n icmp
$IPTABLES -P INPUT DROP

#first log (i think better log only good or only bad)
$IPTABLES -A INPUT -m limit --limit 25/minute -j LOG
#decide to which chain goto...
$IPTABLES -A INPUT -p tcp --port 7180 -j webapp
$IPTABLES -A INPUT -p icmp -j icmp
$IPTABLES -A INPUT -p tcp --dport 22 -j ssh

#fill chain specific for protocol (port was matched before)
$IPTABLES -A webapp -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A icmp -p icmp --icmp-type echo-reply -j ACCEPT
#ssh accept packet to all destionation.. it is quicker then state comparsion
$IPTABLES -A ssh -j ACCEPT 

#for output make other chain than input
$IPTABLES -N ssh_out
$IPTABLES -A OUTPUT -p tcp --sport 22 -j ACCEPT
$IPTABLES -A ssh_out -m state --state ESTABLISHED -j ssh_out
$IPTABLES -A ssh_out -j DROP #or make drop policy on output...

And so one...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.