{"id":21988,"date":"2017-04-18T07:12:34","date_gmt":"2017-04-18T12:12:34","guid":{"rendered":"https:\/\/www.rosehosting.com\/blog\/?p=21988"},"modified":"2022-06-03T03:42:12","modified_gmt":"2022-06-03T08:42:12","slug":"how-to-set-up-a-firewall-with-iptables-on-ubuntu-and-centos","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/how-to-set-up-a-firewall-with-iptables-on-ubuntu-and-centos\/","title":{"rendered":"How to Set Up a Firewall with iptables on Ubuntu and CentOS"},"content":{"rendered":"
<\/p>\n
In this tutorial, we are going to show you how to set up a firewall with iptables<\/strong> on a Linux VPS running Ubuntu<\/a> or CentOS<\/a> as an operating system. Iptables is an administration tool for IPv4 packet filtering and NAT and it is used to set up and manage the tables of IPv4 packet filter rules in the Linux kernel.<\/p>\n Properly configuring and setting up a firewall is one of the most important and crucial things you need to do to secure your server<\/a>. With iptables, several different packet matching tables are defined and each table can contain a number of built-in chains as well as some chains defined by the user. The chains are actually lists of rules that match set of packets and each rule specifies what to do with the matched packet.<\/p>\n The default table is the Connect to your server via SSH<\/a> and list the rules defined in a specific chain using the following syntax:<\/p>\n Replace CHAIN with one of the built-in chains to see the defined rules. If no chain is selected, all chains will be listed in the output.<\/p>\n The firewall rules specify what to do with a certain packet if it matches certain criteria and in case the packet doesn’t match the criteria, the next firewall rule defined in the chain will be examined. This is a very important thing to know when defining the firewall rules because you can easily lock yourself out of your server if you define the rule which accepts packets from your local IP address after the blocking rule.<\/p>\n The targets you can use for the firewall rules are ACCEPT, DROP, QUEUE and RETURN. ACCEPT will let the packet through, DROP will drop the packet, QUEUE will pass the packet to the userspace while RETURN will stop the packet traversing of the current chain and will resume at the next rule in the previous chain. The default chain policy will define what to do with a packet if it doesn’t match certain firewall rule. As you can see in the output of the first command, the default policy for all built-in chains is set to ACCEPT. ACCEPT will let the packet go through so basically there is no protection.<\/p>\n Before adding any specific rules, add the following one:<\/p>\n This will prevent the connections that are already established to be dropped and your current SSH session will remain active.<\/p>\n Next, add rules to allow traffic on your loopback interface:<\/p>\n Next, allow access to your server via SSH for your local IP address so only you can access the server:<\/p>\n Where Next, allow access to your important services like HTTP\/HTTPS server:<\/p>\n [ecko_alert color=”blue”]Stuck somewhere? Get a VPS<\/a> from us and we’ll properly secure your server and configure a firewall for you, free of charge![\/ecko_alert]<\/p>\n Now, list the current rules and check if everything is OK. For detailed output you can use the following command:<\/p>\n If you have other services that you want to allow access to it is best to do that now. Once you are done, you can set the default policy for the INPUT built-in chain to DROP.<\/p>\n This will drop any packet that doesn’t match the firewall rules criteria. The final output should be similar to the following one:<\/p>\n However, if you now restart the server you will lose all the firewall rules you defined so it is really important to make the rules permanent.<\/p>\n In case you are using an\u00a0Ubuntu VPS<\/a> you need to install an additional package for that purpose. Go ahead and install the required package using the following command:<\/p>\n On Ubutnu 14.04<\/strong> you can save and reload the firewall rules using the commands below:<\/p>\n On Ubuntu 16.04<\/strong> use the following commands instead:<\/p>\n If you are using a\u00a0CentOS VPS<\/a> you can save the firewall rules using the command below:<\/p>\n Of course, you don\u2019t have to do any of this if you use one of our Fully Managed VPS Hosting services<\/a>, in which case you can simply ask our expert Linux admins to help you configure your iptables on your server. They are available 24\u00d77 and will take care of your request immediately.<\/p>\n PS<\/strong><\/span>. If you liked this post on How to Set Up a Firewall with iptables on Ubuntu and CentOS, please share it with your friends on the social networks using the buttons below or simply leave a comment in the comments section. Thanks.<\/p>\n","protected":false},"excerpt":{"rendered":" In this tutorial, we are going to show you how to set up a firewall with iptables on a Linux … <\/p>\n
\n<\/p>\nfilter<\/code> table and it contains the built-in chains INPUT, FORWARD, and OUTPUT. The INPUT chain is used for packets destined to local sockets, the FORWARD chain is used for packets being routed through the box while the OUTPUT chain is used for locally-generated packets.<\/p>\n
sudo iptables -L CHAIN<\/pre>\n
sudo iptables -L\r\nChain INPUT (policy ACCEPT)\r\ntarget prot opt source destination\r\n\r\nChain FORWARD (policy ACCEPT)\r\ntarget prot opt source destination\r\n\r\nChain OUTPUT (policy ACCEPT)\r\ntarget prot opt source destination<\/pre>\n
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT<\/pre>\n
sudo iptables -A INPUT -i lo -j ACCEPT\r\nsudo iptables -A OUTPUT -o lo -j ACCEPT<\/pre>\n
sudo iptables -A INPUT -s 111.111.111.111 -p tcp --dport 22 -j ACCEPT<\/pre>\n
111.111.111.111<\/code> is your local IP address and
22<\/code> is the listening port of your SSH daemon. In case your local IP address changes dynamically it is best to omit the
-s 111.111.111.111<\/code> part and use a different method to protect the SSH service from unwanted traffic.<\/p>\n
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT<\/pre>\n
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT\r\nsudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT<\/pre>\n
sudo iptables -nvL<\/pre>\n
sudo iptables -P INPUT -j DROP<\/pre>\n
Chain INPUT (policy DROP 0 packets, 0 bytes)\r\n pkts bytes target prot opt in out source destination\r\n 0 0 ACCEPT all -- * * 0.0.0.0\/0 0.0.0.0\/0 ctstate RELATED,ESTABLISHED\r\n 0 0 ACCEPT all -- lo * 0.0.0.0\/0 0.0.0.0\/0\r\n 0 0 ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 tcp dpt:22\r\n 0 0 ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 tcp dpt:80\r\n 0 0 ACCEPT tcp -- * * 0.0.0.0\/0 0.0.0.0\/0 tcp dpt:443\r\n\r\nChain FORWARD (policy ACCEPT 0 packets, 0 bytes)\r\n pkts bytes target prot opt in out source destination\r\n\r\nChain OUTPUT (policy ACCEPT 0 packets, 0 bytes)\r\n pkts bytes target prot opt in out source destination\r\n 0 0 ACCEPT all -- * lo 0.0.0.0\/0 0.0.0.0\/0\r\n<\/pre>\n
sudo apt-get install iptables-persistent<\/pre>\n
sudo \/etc\/init.d\/iptables-persistent save\r\nsudo \/etc\/init.d\/iptables-persistent reload<\/pre>\n
sudo netfilter-persistent save\r\nsudo netfilter-persistent reload<\/pre>\n
service iptables save<\/pre>\n