1

I have a static IP (on my home pc), is it enough to secure a remote server for my own usage (from my home, static ip, to remote server) using the following rule?

# Allow all loopback (lo0) traffic and reject traffic
# to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT

#Allow traffic from address $STATIC_IP
-A INPUT -s $STATIC_IP -j ACCEPT
-A OUTPUT -d $STATIC_IP -j ACCEPT

#Reject everything else
-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -j REJECT

COMMIT

Edit: This is my final Iptables per Egor Vasilyvev answer

Iptables for normal usage (no dns, no https, no http to external ips, only to my static ip X.X.X.X)

# Allow all loopback (lo0) traffic and reject traffic
# to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A OUTPUT -i lo -j ACCEPT

#Allow traffic from address X.X.X.X
-A INPUT -s X.X.X.X -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

#Reject everything else
-A INPUT -j REJECT
-A FORWARD -j REJECT
-A OUTPUT -j REJECT

COMMIT

Edit: Added rules to allow DNS,HTTP,HTTPS (required for downloading new packges from the distro mirros, and for resolving host names to IP)

Note the additional rule for loopback to prevent spoofing (see discussion below)

-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT

Iptables rules for updating and installing packages

*filter

#Allow all loopback (lo0) traffic and reject traffic
#to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
-A OUTPUT -o lo -j ACCEPT

#Allow traffic from address X.X.X.X
-A INPUT -i eth0 -s X.X.X.X -j ACCEPT
-A OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

#Allow DNS
-A OUTPUT -o eth0 -p udp --dport 53 -j ACCEPT
-A INPUT -i eth0 -p udp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT

#Allow HTTP
-A OUTPUT -o eth0 -p tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT

#Allow HTTPS
-A OUTPUT -o eth0 -p tcp --dport 443 -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

#Reject everything else
-A INPUT -j DROP
-A FORWARD -j DROP
-A OUTPUT -j DROP

COMMIT

At the moment, my solution is to alternate between these 2 rules, using the first rule for normal usage, and changing to the 2nd (with DNS, HTTP and HTTPS) for updating and installing packages.

Improve this question

2 Answers 2

Reset to default
2

Is this server rules? If yes then:

You do not need this rule:

-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT

This rule is anti-spoofing protection. You permit traffic only from and to you PC and if you trust your PC this rule is not needed

Apps that loopback address is needed will not work properly.

You have default policy to REJECT all and you do not have rule that allow OUTPUT loopback traffic. Add this rule to your script:

-A OUTPUT -i lo -j ACCEPT

You server can send any traffic to your PC.

If this is what you need your rules are correct. If only your PC need to initiate data exchange, your rules are incorrect.

Replace this rule:

-A OUTPUT -d $STATIC_IP -j ACCEPT

to this:

-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Improve this answer
6
  • Ok, now I understand. Thank you, your answer is clear and concise, it gives me confidence to setup my vps iptables. Commented Oct 1, 2017 at 14:25
  • @Joey excellent! Do not forget that the settings will be reset after reboot. Use iptables-save to autorestore iptables rules after reboot. Commented Oct 1, 2017 at 14:42
  • I've installed iptables-persistent to save the iptables. Please help me review the 2nd set of rules for HTTPS,DNS and HTTP (edited question) Commented Oct 2, 2017 at 8:30
  • @Joey I would be very grateful if you create a new topic Commented Oct 2, 2017 at 8:45
  • @Joey rule -A OUTPUT -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT accept traffic for ALL established and related connection. You do not need to add tis rule after each allowing rule Commented Oct 2, 2017 at 10:00
1

This restricts the server to only receiving traffic that it sends, and to only sending traffic to itself. With this ruleset, you will not be able to get to the server even for your own use from anywhere else. While this will secure the server, it will also render it unusable, so you probably don't want to do this.

Improve this answer
2
  • Sorry, I was not clear in question, I meant static IP from home, to remote server. Edited question. Thank you. Commented Sep 30, 2017 at 16:09
  • As long as you're using your public IP and not a static IP that's internal to your home network, then you should be okay. I still don't recommend these settings, because you can't look up any hostnames from your server or go anywhere but to your home internet connection from it. Commented Sep 30, 2017 at 17:31

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.