Knowledgebase

Configuring iptables for security on Ubuntu/Debian

Configuring iptables is a crucial step for securing your server. iptables is a powerful network packet management tool in Linux that allows you to filter traffic, limit access, and protect your system from unauthorized access.

Why is it Important to Use iptables?

Traffic Filtering: Allows you to manage incoming and outgoing connections.
Access Limitation: Restricts access to important services and ports.
Attack Protection: Helps protect your server from various network attacks, such as DDoS attacks.

Prerequisites

Server with Ubuntu or Debian: Ensure you have a server running Ubuntu or Debian.
SSH Access: You need SSH access to configure the server.

Basic iptables Commands

Before you start configuring, familiarize yourself with these basic iptables commands:

iptables -A — Add a rule.
iptables -I — Insert a rule.
iptables -D — Delete a rule.
iptables -L — List rules.
iptables -F — Flush all rules.

Step 1: Install iptables

On most Ubuntu/Debian systems, iptables is installed by default. To check or install it, run:

bash

sudo apt update && sudo apt install iptables

Step 2: Clear Existing Rules

Before configuring, it's recommended to clear existing rules:

bash

sudo iptables -F && sudo iptables -X && sudo iptables -t nat -F && sudo iptables -t nat -X && sudo iptables -t mangle -F && sudo iptables -t mangle -X

Step 3: Set Up Basic Rules

Block All Incoming Connections

Start by blocking all incoming connections except those that we explicitly allow:

bash

sudo iptables -P INPUT DROP && sudo iptables -P FORWARD DROP && sudo iptables -P OUTPUT ACCEPT

Allow Local Connections

Allow local loopback connections:

bash

sudo iptables -A INPUT -i lo -j ACCEPT

Allow Existing Connections

Allow all incoming connections that are part of an established connection:

bash

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Step 4: Allow SSH

To enable remote access to your server, allow SSH connections (port 22):

bash

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Step 5: Allow Other Essential Services

Add rules to allow other necessary services, such as HTTP (port 80) and HTTPS (port 443):

bash

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT && sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Step 6: Protect Against DDoS Attacks

Add rules to mitigate DDoS attacks:

bash

sudo iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT && sudo iptables -A INPUT -p tcp --dport 443 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

Step 7: Save Settings

After configuring iptables, save the rules so they persist after a reboot:

bash

sudo sh -c "iptables-save > /etc/iptables/rules.v4"

For Debian/Ubuntu, save rules using the iptables-persistent package:

bash

sudo apt install iptables-persistent && sudo netfilter-persistent save

Step 8: Verify Rules

Check the applied rules with the following command:

bash

sudo iptables -L -v

Configuring iptables is an important step in securing your server. By following these instructions, you can set up basic rules for traffic filtering and protection against network attacks. If you have questions or run into issues, the QCKL support team is always ready to assist.

Proper iptables configuration helps you control access to your server and protect it from unauthorized actions, ensuring the security of your data and systems.