{"id":3477,"date":"2014-08-07T10:41:31","date_gmt":"2014-08-07T15:41:31","guid":{"rendered":"https:\/\/secure.rosehosting.com\/blog\/?p=3477"},"modified":"2022-12-19T06:38:05","modified_gmt":"2022-12-19T12:38:05","slug":"securing-your-ubuntudebian-based-vps-using-iptablesnetfilter-firewall","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/securing-your-ubuntudebian-based-vps-using-iptablesnetfilter-firewall\/","title":{"rendered":"Securing your Ubuntu\/Debian based VPS using IPTABLES\/Netfilter firewall"},"content":{"rendered":"
<\/div>

\"securing-your-ubuntu-based-vps-using-iptables-firewall\"In the following article we will show you how you can secure and protect your Ubuntu or Debian based virtual server<\/a> using a firewall<\/strong> application, called iptables<\/a>.<\/p>\n

What is iptables?<\/strong><\/p>\n

It is is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different Netfilter modules<\/em>) and the chains and rules it stores.<\/p>\n

In order to keep down the number of attempted break-ins and to filter the ports opened on your virtual server<\/a>, it is necessary to properly configure your firewall<\/strong>.<\/p>\n

<\/p>\n

To make the management of your server’s firewall rules easier, we will provide a simple shell script that will help with the management of the firewall rules. Basically, whenever you need to change your firewall rules, you would use this script to add\/remove the desired rule(s).<\/p>\n

SET-UP FIREWALL RULES<\/strong><\/h3>\n

Before wrapping the rules in a script, let’s split it in sections so you can know the design of the firewall and what rules will be in place.<\/p>\n

FLUSH OLD RULES<\/strong><\/h4>\n

The firewall rules can be flushed using the following commands:<\/p>\n

## iptables --flush\r\n## iptables --delete-chain\r\n## iptables --table nat --flush\r\n## iptables --table nat --delete-chain<\/pre>\n
DETERMINE SERVICE PORTS<\/strong><\/h4>\n
You have to know what services you have exposed to the public so you can set appropriate rules for them. One way to find what services are listening on what ports is to use the netstat<\/code> or ss<\/code> commands as in:<\/p>\n
## netstat -tunlp\r\n\r\nor\r\n\r\n## ss -tunlp<\/pre>\n
for example, we are using one of our Ubuntu 12.04 LTS virtual servers<\/a> and the following is the output of the netstat<\/code> command:<\/p>\n
## netstat -tunlp\r\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address           Foreign Address         State       PID\/Program name\r\ntcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      296\/mysqld\r\ntcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN      449\/sendmail: MTA:\r\ntcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN      261\/dovecot\r\ntcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN      261\/dovecot\r\ntcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      590\/apache2\r\ntcp        0      0 209.135.140.77:53       0.0.0.0:*               LISTEN      353\/named\r\ntcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      353\/named\r\ntcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      173\/vsftpd\r\ntcp        0      0 0.0.0.0:5622            0.0.0.0:*               LISTEN      630\/sshd\r\ntcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      449\/sendmail: MTA:\r\ntcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      353\/named\r\ntcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      590\/apache2\r\ntcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      261\/dovecot\r\ntcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN      261\/dovecot\r\nudp        0      0 209.135.140.77:53       0.0.0.0:*                           353\/named\r\nudp        0      0 127.0.0.1:53            0.0.0.0:*                           353\/named<\/pre>\n
so this means that we have the following ports opened to the public:<\/p>\n