firewall

firewall

Firewall configuration and policy management for Linux production servers. Covers UFW for most deployments, iptables and nftables for advanced routing scenarios, and fail2ban for adaptive IP banning. Orbits the network planet.

UFW — Default Policy Design

Start from deny-all inbound, allow-all outbound. Add only what is explicitly required.

# Initial setup — run in order
ufw default deny incoming
ufw default allow outgoing

# Essential services
ufw allow OpenSSH              # 22/tcp — must do this BEFORE ufw enable
ufw allow 80/tcp               # HTTP
ufw allow 443/tcp              # HTTPS

# Activate
ufw enable
ufw status verbose

# Source-restricted rules (principle of least privilege)
ufw allow from 203.0.113.0/24 to any port 5432   # Postgres: specific subnet only
ufw allow from 10.8.0.0/24   to any port 22      # SSH: VPN subnet only
ufw deny  from 198.51.100.0/24                   # block entire range

# Rate-limit brute force on SSH (6 attempts / 30s → block)
ufw limit OpenSSH

# Named application profiles
ufw app list
ufw allow 'Nginx Full'         # opens both 80 and 443

# Modify and delete
ufw status numbered
ufw delete 5                   # remove by number
ufw insert 1 allow from 1.2.3.4   # insert at position 1 (highest priority)
ufw reload

iptables — Hardened Base Ruleset

#!/bin/bash
# /opt/scripts/apply-iptables.sh — idempotent base ruleset

IPT="iptables"

# Flush everything
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t mangle -F

# Default policies — drop everything, build up from nothing
$IPT -P INPUT   DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT  ACCEPT

# Allow loopback
$IPT -A INPUT -i lo -j ACCEPT

# Allow established/related connections
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH, HTTP, HTTPS
$IPT -A INPUT -p tcp --dport 22  -j ACCEPT
$IPT -A INPUT -p tcp --dport 80  -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -j ACCEPT

# ICMP — allow ping but not flooding
$IPT -A INPUT -p icmp --icmp-type echo-request -m limit --limit 10/s -j ACCEPT
$IPT -A INPUT -p icmp -j DROP

# Log and drop everything else
$IPT -A INPUT  -j LOG  --log-prefix "INPUT-DROP: "  --log-level 4
$IPT -A INPUT  -j DROP
$IPT -A FORWARD -j LOG --log-prefix "FORWARD-DROP: " --log-level 4
$IPT -A FORWARD -j DROP

# Persist
iptables-save > /etc/iptables/rules.v4