Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've been using ubuntu server for a while, however I have never really invested time into iptables. I was wondering if there was a recommended way to setup iptables on a basic server intall. An iptables boilerplate essentially.

Also, an explanation of all of the most commonly used ubuntu server ports would be very helpful.

share|improve this question
2  
Is Gufw still in development? help.ubuntu.com/community/Gufw –  djangofan Jan 24 '12 at 21:58

3 Answers 3

up vote 5 down vote accepted

It is fantastic that you are interested in iptables.

As you can see, however, there is a bit of a learning curve.

The basics are

All services listen on ports. One analogy would be an apartment complex, your ports are analogous to apartment numbers.

Common ports are

FTP - 21

SSH - 22

Apache - HTTP 80 ; HTTPS 443

You can get a complete list of ports from a google search or /etc/services

This might help as well

https://help.ubuntu.com/10.04/serverguide/C/index.html

From there, enter iptables. As a firewall, iptables is one way of limiting access.

Basically you have 3 broad options.

  1. Public servers, ie apache. Here you will allow all traffic and blacklist bad acting IP (spammers)

  2. Private servers, ie ssh. Here you will deny all traffic and white list authorized connections.

  3. Limit. You may allow ping, but only at a certain rate.

If you are new to iptables, you may wish to start with ufw. ufw is a command line front end to iptables and is easier to learn. The syntax is very similar to iptables so it is easy to transition from ufw to iptables.

See:

https://help.ubuntu.com/community/UFW

https://help.ubuntu.com/community/IptablesHowTo

That information should get you started. If you have a problem, feel free to ask a more specific question.

I also have an introductory page to iptables if you like. I have maintained it over the years with feedback from people new to iptables, hope it helps.

http://bodhizazen.net/Tutorials/iptables

share|improve this answer
    
/etc/ports? You mean /etc/services? –  arrange Jan 24 '12 at 21:18
    
sorry about that. –  bodhi.zazen Jan 24 '12 at 21:46
    
no need to be sorry :) Your posts, blog and other resources have always been a great help to me. Thanks for all that. –  arrange Jan 25 '12 at 10:38
    
Hmm, is there any disadvantage to using ufw for basic setup? –  mr axilus Jan 25 '12 at 12:45
    
The only disadvantages I can think of would be personal preferences, some people may prefer alternate tools (alternate graphical tools, iptables) or have preferred options (DROP vs REJECT). The other "disadvantage" would be that if you did wish to run a service (ssh, samba, nfs, VNC) you would then need to open the port in your firewall. –  bodhi.zazen Jan 25 '12 at 16:07

The recommended way (for beginners) is to enable ufw which in turn automatically sets up basic iptables rules for you:

sudo ufw enable

Basically this will block all unsolicited packets (for the full list of rules that are set up this way see sudo iptables -L).

To be able to connect to the server, you will have to allow a few ports, for instance

sudo ufw allow 22/tcp

to allow ssh etc.

share|improve this answer

I recommend that you also add protection against some scan types and unusual (possibly malicious) tcp settings:


-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE  -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -m state --state INVALID -j DROP

(Via hideandhack.com.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.