Home / server / Questions / 769343
Accepted
LinuxSecurityFreak
Asked: 2016-04-11 11:10:13 +0800 CST

Firewall rules on a hosting (dedicated server)

  • 772

I am on Linux Debian Jessie 8.4.

I have set up a web server. It seems to run fine.

I'm just wondering, if I need the following firewall rules are ok for HTTP(S) server to be running fine.

iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 10100 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

The server is behind a router. Port 22 is not forwarded. 10100 is used for passive FTP

Thank you.

web-server iptables

1 Answers

  1. Best Answer

    Typically you want to block everything that isn't explicitly allowed and should add a final rule after what you already have : 

    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    • 0