{"id":288,"date":"2011-09-22T18:39:29","date_gmt":"2011-09-22T23:39:29","guid":{"rendered":"https:\/\/www.bodhost.com\/blog\/?p=288"},"modified":"2026-02-26T13:59:07","modified_gmt":"2026-02-26T13:59:07","slug":"secure-your-dedicated-server-with-iptables","status":"publish","type":"post","link":"https:\/\/www.bodhost.com\/blog\/secure-your-dedicated-server-with-iptables\/","title":{"rendered":"Secure your dedicated server with Iptables"},"content":{"rendered":"

In this article, we’ll see how to secure your dedicated server<\/a> by configuring three essential programs:<\/p>\n

* Iptables: Firewall is the Linux systems, it is difficult to handle the first time but you can make very fine adjustments. In this tutorial I propose a set of standard rules for a web server.
\n* Fail2ban: it is a system that automatically ban all users who try to connect several times without success on our server. It helps prevent brute force attacks.
\n* Rkhunter: it is a software that warns of sensitive files that are changed. In other words, a good detector Backdoor and Rootkit.<\/p>\n

And as a bonus, I would give you a tips to be prevented by email when someone’s logs into SSH on your server. At the end of the article you will have a secure Web server already, but not enough for my taste, hence the second article will gives you little more tips about how secure php scripts with Apache 2 modules.<\/p>\n

I think this mini tutorial on iptables, with the arguments most commonly used and these basic principles will not hurt. I’ll do that in a list to make this easier, the goal is not to be exhaustive.<\/p>\n

If you do a iptables-L, you will see the rules that define your firewall. Looking at the results more closely, we see three types of chains:<\/strong><\/p>\n

* INPUT: corresponds to the rules of the incoming traffic from the server
\n* OUTPUT: corresponds to the rules for outgoing traffic the server
\n* FORWARD: the rules to make redirects<\/p>\n

We also note that we have the firewall’s policy on “acceptable” for all channels and it is not very good at security. Our approach will be of any block (DROP) and then slowly release the ports for the services we use.<\/p>\n

Here is a list of arguments that are used frequently:<\/strong><\/p>\n

*-T: specify on which table you are working, it’s default filter that contains the input, output and forward
\n*-A: adds a rule at the end of string
\n*-P: specifies the protocol of the rule (usually TCP, UDP or ICMP for ping)
\n*-Dport: specifies the destination port
\n*-D: specifies the policy to apply (or accept drop most of the time)
\n* F-: clear all rules (F = Flush)
\n*-X: erase chain<\/p>\n

Configuration rules<\/strong><\/p>\n

To set up a firewall on Linux, most of the time you create a bash file with all the iptables commands that you want to. In my case, I put iptables to 0, then I block everything, then I slowly unlocked the services I use. Therefore, the order is important! Here is the file used for the video, remember to change the port number for ssh or otherwise you will be blocked (a hardware reboot will do you unlock).<\/p>\n

#!\/bin\/sh
\n### BEGIN INIT INFO
\n# Provides: Firewall maison
\n# Required-Start: $local_fs $remote_fs $network $syslog
\n# Required-Stop: $local_fs $remote_fs $network $syslog
\n# Default-Start:
\n# Default-Stop:
\n# X-Interactive: false
\n# Short-Description: Firewall maison
\n### END INIT INFO<\/p>\n

# Mise \u00e0 0
\niptables -t filter -F
\niptables -t filter -X
\necho “Mise \u00e0 0”<\/p>\n

# On bloque tout
\niptables -t filter -P INPUT DROP
\niptables -t filter -P FORWARD DROP
\niptables -t filter -P OUTPUT DROP
\necho “Interdiction”<\/p>\n

# Ne pas casser les connexions \u00e9tablies
\niptables -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
\niptables -A OUTPUT -m state –state RELATED,ESTABLISHED -j ACCEPT<\/p>\n

# Autorise le loopback (127.0.0.1)
\niptables -t filter -A INPUT -i lo -j ACCEPT
\niptables -t filter -A OUTPUT -o lo -j ACCEPT
\necho “Loopback”<\/p>\n

# ICMP (le ping)
\niptables -t filter -A INPUT -p icmp -j ACCEPT
\niptables -t filter -A OUTPUT -p icmp -j ACCEPT
\necho “Ping ok”<\/p>\n

# SSH IN\/OUT
\niptables -t filter -A INPUT -p tcp –dport 1337 -j ACCEPT
\niptables -t filter -A OUTPUT -p tcp –dport 1337 -j ACCEPT
\necho “SSH ok”<\/p>\n

# DNS In\/Out
\niptables -t filter -A OUTPUT -p tcp –dport 53 -j ACCEPT
\niptables -t filter -A OUTPUT -p udp –dport 53 -j ACCEPT
\niptables -t filter -A INPUT -p tcp –dport 53 -j ACCEPT
\niptables -t filter -A INPUT -p udp –dport 53 -j ACCEPT
\necho “dns ok”<\/p>\n

# NTP Out
\niptables -t filter -A OUTPUT -p udp –dport 123 -j ACCEPT
\necho “ntp ok”<\/p>\n

# HTTP + HTTPS Out
\niptables -t filter -A OUTPUT -p tcp –dport 80 -j ACCEPT
\niptables -t filter -A OUTPUT -p tcp –dport 443 -j ACCEPT<\/p>\n

# HTTP + HTTPS In
\niptables -t filter -A INPUT -p tcp –dport 80 -j ACCEPT
\niptables -t filter -A INPUT -p tcp –dport 443 -j ACCEPT
\niptables -t filter -A INPUT -p tcp –dport 8443 -j ACCEPT
\necho “http ok”<\/p>\n

# FTP Out
\niptables -t filter -A OUTPUT -p tcp –dport 21 -j ACCEPT
\niptables -t filter -A OUTPUT -p tcp –dport 20 -j ACCEPT<\/p>\n

# FTP In
\n# imodprobe ip_conntrack_ftp # ligne facultative avec les serveurs OVH
\niptables -t filter -A INPUT -p tcp –dport 20 -j ACCEPT
\niptables -t filter -A INPUT -p tcp –dport 21 -j ACCEPT
\niptables -t filter -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
\necho “ftp ok”<\/p>\n

# Mail SMTP:25
\niptables -t filter -A INPUT -p tcp –dport 25 -j ACCEPT
\niptables -t filter -A OUTPUT -p tcp –dport 25 -j ACCEPT<\/p>\n

# Mail POP3:110
\niptables -t filter -A INPUT -p tcp –dport 110 -j ACCEPT
\niptables -t filter -A OUTPUT -p tcp –dport 110 -j ACCEPT<\/p>\n

# Mail IMAP:143
\niptables -t filter -A INPUT -p tcp –dport 143 -j ACCEPT
\niptables -t filter -A OUTPUT -p tcp –dport 143 -j ACCEPT<\/p>\n

# Mail POP3S:995
\niptables -t filter -A INPUT -p tcp –dport 995 -j ACCEPT
\niptables -t filter -A OUTPUT -p tcp –dport 995 -j ACCEPT
\necho “mail ok”<\/p>\n

# Monit
\niptables -t filter -A INPUT -p tcp –dport 4598 -j ACCEPT<\/p>\n

# Webmin
\niptables -t filter -A INPUT -p tcp –dport 10000 -j ACCEPT
\necho “monitoring ok”<\/p>\n

The upper part is optional but it avoids warnings in log files. At the level of difficulty, once you understand a line to the rest comes by itself. Remember to give execute permissions to this file (chmod + x firewall) and place it in \/ etc \/ init.d \/ and activate it to start the server with update-rc.d firewall defaults (but make sure that the file is working properly before!)<\/p>\n

I take this opportunity to pass to give you my script to the proper iptables back to 0 in case of trouble:<\/p>\n

#!\/bin\/sh
\necho “Flushing iptables rules…”
\nsleep 1
\niptables -F
\niptables -X
\niptables -t nat -F
\niptables -t nat -X
\niptables -t mangle -F
\niptables -t mangle -X
\niptables -P INPUT ACCEPT
\niptables -P FORWARD ACCEPT
\niptables -P OUTPUT ACCEPT<\/p>\n

That’s all on the side of the Firewall. If one day you install additional services and that it does not work, remember to look to the Firewall, you tend to forget when the configuration is finished.<\/p>\n","protected":false},"excerpt":{"rendered":"

In this article, we’ll see how to secure your dedicated server by configuring three essential programs: * Iptables: Firewall is the Linux systems, it is difficult to handle the first…<\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[42],"tags":[14,88],"class_list":["post-288","post","type-post","status-publish","format-standard","hentry","category-dedicated-servers","tag-dedicated-server","tag-iptables"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t