Building A Firewall For A Debian Spider Web Server

This postal service addresses how to configure the Linux firewall to protect a Debian-based spider web application server. While at that topographic point are GUI tools for the job, nosotros volition focus on the command-line tool iptables.

The scenario is that yous receive got only installed Debian (or Ubuntu) on a server connected to the Internet. This volition hold upward used equally a spider web server hosting your WordPress blog. I assume that yous already receive got Apache, too WordPress installed. Please cite to my earlier post for instructions on how to install WordPress on Debian.

Basic Requirements

Before nosotros attain the firewall, let's write downward the basic requirements - the types of traffic the auto volition bring too those it volition drop.

• Accept all outbound traffic (from server to the Internet).
• Accept all traffic from the loopback(lo) interface, which is necessary for many applications.
• Accept inbound ssh logins.
• Accept inbound Web requests.
• Accept inbound ping requests.
• Log firewall-specific warnings.

Build firewall

Please follow the gild of the steps below. The procedural gild is designed to minimize the conduct chances of locking yourself out past times mis-configuring the firewall.

1. Log inwards to the server either on the physical console or remotely via ssh.

   The physical console is amend because too therefore yous don't postulate to worry most beingness locked out. However, it is non ever possible to access the console because the auto may hold upward sitting afar inwards a information center.

2. Examine the electrical current firewall configuration.

    $ sudo iptables -L Chain INPUT (policy ACCEPT) target  prot opt source  destination           Chain FORWARD (policy ACCEPT) target  prot opt source  destination           Chain OUTPUT (policy ACCEPT) target  prot opt source  destination          

   Note the policies for INPUT, FORWARD, too OUTPUT. The typical default firewall is configured to bring all traffic, both inbound too outbound.

3. Flush the firewall.

   Flush exclusively if:

   • your firewall is non 'clean' - it has existing rules, too
   • the INPUT policy is ACCEPT.

   If the INPUT policy is non ACCEPT, yous tin perish inwards therefore similar this:

    $ sudo iptables -P INPUT ACCEPT 

   To even the firewall:

    $ sudo iptables -F 

   Now, nosotros are ready to add together the firewall rules, i past times one. Note that they comprise the basic rules to satisfy our stated requirements. Not included are specific rules to thwart mutual Internet attacks.

4. Add dominion # 1.

    $ sudo iptables -I INPUT 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 

   The to a higher house dominion accepts whatever incoming traffic that is business office of, or related to, an existing connection. If yous are currently logged inwards via a remote ssh session, this dominion prevents yous from beingness locked out. So, it is of import that yous attain it first.

5. Add dominion # 2.

    $ sudo iptables -I INPUT two -i lo -j ACCEPT 

   This dominion accepts all traffic from the loopback interface (localhost/127.0.0.1).

6. Add dominion # 3.

    $ sudo iptables -I INPUT iii -m conntrack --ctstate NEW -p tcp --syn --dport lxxx --j ACCEPT 

   This dominion accepts all novel incoming WordPress connections to port 80.

7. Add dominion # 4.

    $ sudo iptables -I INPUT four -m conntrack --ctstate NEW -p tcp --syn --dport 22 --j ACCEPT 

   Rule # four accepts all novel incoming ssh sessions to port 22.

8. Add dominion # 5.

    $ sudo iptables -I INPUT v -p icmp --icmp-type echo-request -m boundary --limit 2/second -j ACCEPT 

   This dominion accepts incoming ping echo requests at the maximum charge per unit of measurement of two requests per second.

9. Add dominion # 6.

    $ sudo iptables -I INPUT vi -m boundary --limit 2/min  -j LOG --log-prefix "INPUT:DROP:" --log-level vi 

   All incoming traffic that are non accepted past times whatever prior dominion perish logged at a maximum charge per unit of measurement of two entries per minute. The default log file is /var/log/messages. For tardily identification, the log entries are prefixed amongst the string 'Input:Drop:'.

10. Change default INPUT too FORWARD policies to DROP.

    With the policy change, all incoming traffic non explicitly accepted past times whatever of the to a higher house rules are dropped.

     $ sudo iptables -P INPUT DROP $ sudo iptables -P FORWARD DROP 

Your basic firewall is complete. You tin sentiment the newly created firewall rules via the following:

    $ sudo iptables -v -L Chain INPUT (policy DROP 147 packets, 51908 bytes)  pkts bytes target     prot opt inwards     out     source               destination           1304  487K ACCEPT     all  --  whatever    whatever     anywhere             anywhere             ctstate RELATED,ESTABLISHED     0     0 ACCEPT     all  --  lo     whatever     anywhere             anywhere                 0     0 ACCEPT     tcp  --  whatever    whatever     anywhere             anywhere             ctstate NEW tcp dpt:httpflags: FIN,SYN,RST,ACK/SYN     0     0 ACCEPT     tcp  --  whatever    whatever     anywhere             anywhere             ctstate NEW tcp dpt:sshflags: FIN,SYN,RST,ACK/SYN     0     0 ACCEPT     icmp --  whatever    whatever     anywhere             anywhere             icmp echo-request limit: avg 2/sec flare-up v     ix  2954 LOG        all  --  whatever    whatever     anywhere             anywhere             limit: avg 2/min flare-up v LOG marker information prefix "INPUT:DROP:"  Chain FORWARD (policy DROP 0 packets, 0 bytes)  pkts bytes target     prot opt inwards     out     source               destination           Chain OUTPUT (policy ACCEPT 198 packets, 31420 bytes)  pkts bytes target     prot opt inwards     out     source               destination 

Save firewall

The firewall that yous only created volition non persist. If yous reboot the server, the firewall volition revert to the default configuration - bring all traffic - before yous made all the to a higher house modifications. To salve the firewall changes permanently,

1. Install iptables-persistent package.

    $ sudo apt-get install iptables-persistent 

2. Make an explicit save.

   After yous destination modifying the firewall, yous postulate to explicitly salve the firewall configuration inwards the file /etc/iptables/rules.v4 using the ascendancy below.

    $ sudo sh -c "iptables-save > /etc/iptables/rules.v4" 

Custom log file

The to a higher house firewall logs all dropped incoming traffic to the full general organization log file /var/log/messages. To avoid cluttering the file, I recommend sending the iptables-related log entries to a assort file, enjoin /var/log/iptables.log. This is possible because iptables-related log entries are prefixed amongst a custom identifier - 'INPUT:DROP:'.

1. Create a rsyslog dominion to redirect firewall log entries.

   H5N1 novel file /etc/rsyslog.d/10-iptables.conf is created to concord the rsyslog rule.

    $ truthful cat > /etc/rsyslog.d/10-iptables.conf :msg, contains, "INPUT:DROP:" -/var/log/iptables.log &   

   The root delineate inwards the file specifies that if a log entry contains the custom identifier, it is sent to /var/log/iptables.log.

   The 2nd delineate skips forwards to the side past times side log entry, thereby preventing double logging into /var/log/messages.

2. Restart rsyslog daemon.

    $ sudo service rsyslog restart 

Share this post