Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I set up iptables for my server running LAMP. I want to know if there's someway to improve my current firewall setup.

*filter

:INPUT DROP [14:1434]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

#SSH
##HOME
  -A INPUT -i eth0 -p tcp -s 1xx.1xx.1.xx/255.255.255.0 --dport 9991 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A OUTPUT -o eth0 -p tcp --sport 9001 -m state --state ESTABLISHED -j ACCEPT

##PSd
  -A INPUT -i eth0 -p tcp -s xx.xxx.xxx.xxx/255.255.255.0 --dport 9991 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A OUTPUT -o eth0 -p tcp --sport 9991 -m state --state ESTABLISHED -j ACCEPT

#HTTP
  -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT

#HTTPS
  -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED,RELATED -j ACCEPT


#Loop Back (FOR MY SQL!!)
  -A INPUT -i lo -j ACCEPT
  -A OUTPUT -o lo -j ACCEPT

#Stopping DDOS
  -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
  -A INPUT -p tcp --dport 443 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

#Allowing Mail
  -A OUTPUT -o eth0 -p tcp --sport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A OUTPUT -o eth0 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
  -A INPUT -i eth0 -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

# DNS
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT

#apt-get
-A INPUT -p tcp --sport 80 -j ACCEPT

COMMIT

I use this server to host my small business website. -SSH is used to change the website (SFTP through Filezilla) -SMTP is used to send mail through a contact form (I use gmail as a relay)

If possible, could you tell me how these holes would be exploited as well? You don't have to go into detail. I'm just trying to build a better understanding of this sort of stuff. Thanks :)!

If there's more information needed to answer this question let me know

share|improve this question
1  
If you want to change/clarify your question please do it by editing the question, not in a comment. You can delete the comment afterwards. –  guntbert Aug 24 '13 at 21:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.