Home / server / Questions / 145144
Accepted
Anonymous12345
Asked: 2010-05-26 08:16:20 +0800 CST

Does a VPS need a firewall?

  • 772

Do I need a firewall on my VPS which I ordered today?

If so, which one would you recommend?

I plan on running a classifieds website with Java, php, mysql. My OS is ubuntu 9.10

Thanks

Btw: What is iptables?

linux ubuntu apache-2.2 security

4 Answers

  1. Security is best done in layers. Aside from a little extra work adding a host-based firewall to your VPS shouldn't hurt anything and may protect your system from some attacks.

    Iptables is a command line tool that manages the rules in the kernel netfilter infrastructure. Almost every linux-based firewall uses iptables. You could say there really is only one Linux firewall, just lots of tools that manipulate the rules in different ways.

    As for which firewall to use personally I really like firehol, but there are many alternatives a search for linux firewall will return many questions where various firewall management tools are discussed.

    • 3
  2. Best Answer

    I recommend following the IPTables guide on slicehost. They have a good basic rule set that allows incoming SSH, HTTP(S), and ping while allowing your server to send anything out.

    These guides also help you to setup just about everything else you could need in a VPS so you should really take some time and read them. http://library.linode.com/ is also a great place to read up on these things.

    • 3

  3. Security is indeed best done in layers as Zoredache said. Reassurance of being in control is also important for peace of mind. Look in to a HIDS (Host intrusion detection system)

    HIDS is like having your mother watch your kids while you go out and party. My suggestion is OSSEC as it is very easy to install and will teach you allot about all aspects of your system.

    OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS). It has a powerful correlation and analysis engine, integrating log analysis, file integrity checking, Windows registry monitoring, centralized policy enforcement, rootkit detection, real-time alerting and active response.

    It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows.

    • 2

  4. What is iptables?

    It's the firewall and network routing layer you'd install on Linux. As Zoredache says, it's kernel level and it's well trusted for the job it does. It's very powerful so can be quite hard to understand. For this reason there are a blight of interfaces for editing iptables config. My favourite is ufw as it's very simple to install on Ubuntu and it's very simple to see the rules and edit them.

    Should you install one? Probably.

    Should you just rely on a firewall? Definitely not.

    A secure server means more than a firewall. A firewall only decides which traffic reaches you. If you want to stop people brute-forcing their way through SSH or FTP, you can use fail2ban and/or move their port (I use a high --over 10,000-- port for sshd to stop people guessing it quickly) and you can set SSH to only allow authentication by key (vs password) which is a lot more secure.

    A firewall just makes it easy to say "Right I only want the internet to be able to see a webserver and a ssh server, and everything else is only local".

    • 2