iptables (strict) Linux VPS
firewall rules:
Reference:
https://help.ubuntu.com/community/IptablesHowTosudo iptables -A INPUT -i lo -j ACCEPT
// Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
// "We can allow established sessions to receive traffic:"
or
// "If the line above doesn't work, you may be on a castrated VPS whose provider has not made available the extension, in which case an inferior version can be used as last resort: "
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
N.B. It's probably best to avoid using conntrack if your running a Tor .exit node.
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
// Accept incoming port 22 for SSH VPS login. Change this to your own non-standard SSH port if required.
sudo iptables -A INPUT -p tcp --dport 43 -j ACCEPT
// Accept port 43 for WHOIS protocol Fail2ban look-ups.
sudo iptables -A INPUT -p tcp --dport 53 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 53 -j ACCEPT
// Accept port 53 for DNS.
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
// Optionally. Accept port 80 for your http web server or Tor DirPort (alternate port 9030).
sudo iptables -A INPUT -p udp --dport 123 -j ACCEPT
// Accept port 123 UDP for Network Time Protocol (NTP), used for time synchronization.
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
// Optionally. Accept port 443 for your https web server or Tor ORPort (alternate port 9001).
sudo iptables -A INPUT -p tcp --dport 8332 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
// Restrict Bitcoin RPC port 8332 to only accept localhost source and destination traffic.
sudo iptables -A INPUT -p tcp --dport 8333 -j ACCEPT
// Accept port 8333 for Bitcoin incoming connections.
sudo iptables -A INPUT -p tcp --dport 9050 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
// Restrict Tor SOCKS Port 9050 to only accept localhost source and destination traffic.
sudo iptables -A INPUT -p tcp --dport 9051 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
// Restrict Tor Control Port 9051 to only accept localhost source and destination traffic.
N.B. Consider other ports you might need to accept here i.e. for TorDNS, VNC server access, git clone, key servers etc.,// Allow several ICMP types
-
http://www.oregontechsupport.com/articles/icmp.txtsudo iptables -A INPUT -p icmp -m icmp --icmp-type host-unreachable -j ACCEPT
sudo iptables -A INPUT -p icmp -m icmp --icmp-type port-unreachable -j ACCEPT
sudo iptables -A INPUT -p icmp -m icmp --icmp-type fragmentation-needed -j ACCEPT
sudo iptables -A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
sudo iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 2/s -j ACCEPT
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
// Drop non-established TCP
sudo iptables -A INPUT -p tcp --syn -j DROP
// Optionally. Drop everything else !!!
sudo iptables -A INPUT -j DROP
N.B. Some Tor node operators (pool operators?) might prefer to avoid conntrack and still allow all UDP traffic etc.,
// Allow outgoing connections
sudo iptables -A OUTPUT -o lo -j ACCEPT
...
Now save your iptables firewall config. with:
sh -c "iptables-save -c >etc/iptables.rules"
// sudo sh (if required)
Reload your (saved) iptables firewall rules after a server restart with;
sh -c "iptables-restore -c <etc/iptables.rules"
// sudo sh (if required)
// and it's probably best to restart Fail2ban (if we have installed it, see above post)
sudoetc/init.d/fail2ban restart
// list your iptables with:
sudo iptables -L
N.B. No firewall solution is perfect, although this example iptables firewall + Fail2ban is a fairly solid solution, which is certainly more effective than having no firewall in place whatsoever.
