Check Iptables Firewall set up on Centos 6

Check-Iptables-Firewall-set-up-on-Centos-6

You can use Iptables to secure your Linux server or VPS. With Iptables you can monitor the traffic of your server using tables, which are a set of rules called chains. Iptables is a flexible firewall tool and few tricks and commands could make working with Iptables much easier.

To configure firewall rules for IPv6, you will have to set up the ip6tables service. If you are using CentOS 7, you will need to set up your firewall using firewalld.

Now lets see how to create a simple firewall on a Centos VPS:

Decide the services and ports to open

Once you have choosed the port to be opened, all other unnecessary ports will be blocked.

You are going to leave SSH port open so that you can connect to the VPS remotely:

Let’s say, port 22.

For web traffic open port 80 and 443. To send email, open port 25 (regular SMTP) and 465 (secure SMTP) and to receive open the usual port 110 (POP3) and 995 (secure POP3 port).

Block comman attacks using iptables

You can block common network attacks with the help of iptables; We will discuss few  attacks:

-> To block null packets use the below command

iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

-> To reject is a syn-flood attack you can use

iptables -A INPUT -p tcp ! --syn-m state --state NEW -j DROP

Note:

–i : Insert a rule

-A : Append

-j option specifies the target if a rule is matched

-> To block XMAS packets

iptables -A INPUT -p tcp
--tcp-flags ALL ALL -j DROP

The server allocates a large number of resources for this packet, as it requires more processing than the usual packets.

Add selected services

Open the ports for your selected services and start adding to the firewall filter. Let’s start with localhost interface:

iptables -A INPUT -i lo -j ACCEPT

This command tells iptables to add a rule to the incoming filter table (INPUT) and accept (-j ACCEPT) the traffic that comes via the localhost interface.

Next you can allow web server traffic by adding the two ports to ACCEPT the change.

iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Then you can allow users to use your SMTP servers, using:

iptables -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT

This command will allow users to read email on their server which allow POP3 traffic.

iptables -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 995 -j ACCEPT

Next you can allow IMAP mail protocol:

iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 993 -j ACCEPT

Limiting SSH access

To allow SSH traffic, connect to the VPS remotely by the following command:

iptables -A INPUT -p tcp -m tcp--dport 22 -j ACCEPT

Note: You can change the SSH configuration to a different port if needed.         

If you hold a permanent IP address, you can allow connection to SSH and the connection is available only to users around your location.

Once after finding your IP address, you can create the firewall rule to allow traffic to the SSH port and then replace YOUR_IP_ADDRESS with the actual IP.

iptables -A INPUT -p tcp -s YOUR_IP_ADDRESS -m tcp --dport 22 -j ACCEPT

You can open more ports on your firewall by changing the port numbers. So that you can access the services you require. In order to use outgoing connections add the below rule

iptables -I INPUT -m state--state ESTABLISHED,RELATED -j ACCEPT

Through this you will receive replies from the VPS on the other side of the connection. Once set up is done you can block everything else, and allow all other outgoing connections.

iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP

Save the configuration

Now list the rules to see if anything is missing out:

iptables -L –n               

-n : indicates only ip addresses, not a domain name.

You can save your firewall configuration by

iptables-save | sudo tee /etc/sysconfig/iptables

To ensure everything works fine, just restart the firewall. The saved rules will run even when the VPS is rebooted.

service iptables restart

Flush to unlock yourself

In case if you block yourselves from accessing the VPS, the Digital Ocean web interface will allow us to connect to the server via console access.

To get back to the VPS again, you can use the following command which will flush the filters, once logged in.

iptables -F

Hope you liked it and if any assistance needed Contact Us.

Follow us on Facebook, Twitter to get latest updates!

Subscribe to get free blog content to your Inbox