In order to make a server more secure after the initial set up, Ubuntu
ships with Iptables which is the distribution’s default firewall. At
the outset, although the Ubuntu firewall is configured, it is set up to
allow all incoming and outgoing traffic on a vritual private server. To
enable some stronger protection on the server, we can add some basic
rules to the IP Table.
The IP table rules come from a series of options that can be combined to
create each specific process. Each packet that crossing the firewall is
checked by each rule in order. As soon as it matches a rule, the packet
follows the associated action, otherwise it proceeds down the line.
IP Table Commands
Although this tutorial will go over a limited amount of commands that
would provide a server with some basic security, there are a variety of
nuanced and specific cases that can be developed for the IP Table.
Below are some of the most useful commands for developing a firewall for
your VPS, but keep in mind that this is a short list and there are a
variety of other options.
-A: (Append), adds a rule to the IP Tables
-L: (List), shows the current rules
-m conntrack: allows rules to be based on the current connection state, elaborated in the the --cstate command.
--cstate: explains the states that connections can be in, there are 4: New, Related, Established, and Invalid
-p: (port), refers to the the port through which the machine connects
-j: (jump), this command refers to the action that needs to be taken if something matches a rule perfectly. It translates to one of four possibilities:
-ACCEPT: the packet is accepted, and no further rules are processed
-REJECT: the packet is rejected, and the sender is notified, and no further rules are processed
-DROP: the packet is rejected, but the sender is not notified, and no further rules are processed
-LOG: the packet is accepted but logged, and the following rules are processed
-I: (Insert), adds a rule between two previous ones
-I INPUT 3: inserts a rule into the IP Table to make it the third in the list
-v: (verbose), offers more details about a rule
Creating the IP Table:
If you type in the following, you can see the current rules in the virtual server's IP Table:
sudo iptables -L
They should look like this:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
If you have another set of rules in place or want to start fresh, you
can always set the rules back to the default by flushing and deleting
all of them:
sudo iptables -F
Additionally, if you want speed up your work with IP Table, you can
include -n in the command. This option disables DNS lookups and prevents
the command from trying to find the reverse of each IP in the ruleset.
You could use this to list rules, as an example:
iptables -L -n
A Basic Firewall
As it stands the current rules allow all connections, both incoming and
outgoing. There are no security measures in place whatsoever. As we
build up the table, keep in mind that as soon as a packet is ACCEPTED,
REJECTED, or DROPPED, no further rules are processed. Therefore the
rules that come first take priority over later ones.
While creating the rules, we have to be sure to prevent ourselves from
accidentally blocking SSH (the method through which we connected to the
server).
To start off, let’s be sure to allow all current connections, all of the
connections at the time of making the rule, will stay online:
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
We can go ahead and break this down:
- -A tells the IP table to append a rule to the table.
- INPUT designates this rule as part of the Input chain.
- m conntrack followed by the --cstate ESTABLISHED,RELATED guarantees that the result of this rule will only apply to current connections and those related to them are allowed
- -j ACCEPT tells the packet to JUMP to accept and the connections are still in place.
After we are assured that all the current connections to the virtual
private server can stay up uninterrupted, we can proceed to start
blocking off other insecure connections.
-
Let’s assume that we want to block all incoming traffic, except for
those coming in on 2 common ports: 22 for SSH and 80 for web traffic. We
proceed by allowing all traffic on the designated ports with the
following commands:
sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
In both of these commands, the
-p option stands for the protocol with which the connection is being made, in this case
tcp, while the
--dport specifies the port through which the packet is being transmitted.
After we have guaranteed that the desirable traffic will make it through
the firewall, we can finish up by blocking all remaing traffic from
accessing our virtual server. Because this is the last rule in the list,
all traffic that matches any of the previous rules in the IP Table will
not be affected, and will be treated as we set up previously.
-
Let’s make a rule to block all of the remaining traffic:
sudo iptables -A INPUT -j DROP
With that, we can see what our updated rules look like:
sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:http
DROP all -- anywhere anywhere
-
We are almost finished. However, we are missing one more rule. We need
to provide our VPS with loopback access. If we were to add the rule now
without further qualifiers, it would go to the end of the list and,
since it would follow the rule to block all traffic, would never be put
into effect.
In order to counter this issue, we need to make this rule first in the list, using the INPUT option :
sudo iptables -I INPUT 1 -i lo -j ACCEPT
- -I INPUT 1 places this rule at the beginning of the table
- lo refers to the loopback interface
- -j ACCEPT then guarantees that the loopback traffic will be accepted
Now we have finished creating a basic firewall. Your rules should look
like this (we can see the details of the iptable by typing -v):
sudo iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
1289 93442 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
2 212 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:http
47 2422 DROP all -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 157 packets, 25300 bytes)
pkts bytes target prot opt in out source destination
However, as soon as the virtual server reboots, the IP tables will be
wiped. The next step will go over saving and restoring the IP tables.
Saving IP Tables
Although the IP tables are effective, they will automatically be deleted
if the server reboots. To make sure that they remain in effect, we can
use a package called IP-Tables persistent.
We can install it using apt-get:
sudo apt-get install iptables-persistent
During the installation, you will be asked if you want to save the
iptable rules to both the IPv4 rules and the IPv6 rules. Say yes to
both.
Your rules will then be saved in /etc/iptables/rules.v4 and /etc/iptables/rules.v6.
Once the installation is complete, start iptables-persistent running:
sudo service iptables-persistent start
After any server reboot, you will see that the rules remain in place.
Regards,
Anzil Ali Liyakkath
Technical support
Myloth Technologies Pvt. Ltd.
Technical Wing: WebHostRepo Software Solutions
web:http://www.webhostrepo.com
twitter:http://twitter.com/webhostrepo
facebook:http://facebook.com/webhostreposs
linkedin:http://in.linkedin.com/in/webhostrepo
Munin is a networked resource monitoring tool that can help analyze
resource trends and usage. It can monitor a wide variety of servers and
equipment e.g. servers, vpss, networks, applications etc