How to protect a linux server with a firewall?

Question

linux

Hello! Please tell me how the firewall should be properly configured in order to protect a server connected to the Internet around the clock. Here is the script that loads the firewall on my server:

#!/bin/sh
## Очистка таблиц
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

## Отфильтровывание пакетов с локальным адресом
iptables -t filter -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
iptables -t filter -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
iptables –t filter –A INPUT –i eth0 –s 10.0.0.0/8 –j DROP

## Отфильтровывание пакетов на широковещательный адрес
iptables –t filter –A INPUT –i eth0 –d 255.255.255.255 –j DROP

## Разрешить lo и внутреннюю сеть
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -i eth1 -j ACCEPT

## Разрешить icmp
iptables –t filter -A INPUT -i eth0 -p icmp -j ACCEPT

## Закрытие портов входящих соединений, кроме ssh
iptables –t filter -A INPUT -i eth0 -p udp -m state –state RELATED,ESTABLISHED -j ACCEPT
iptables –t filter -A INPUT -i eth0 -p tcp -m state –state RELATED,ESTABLISHED -j ACCEPT
iptables –t filter -A INPUT -i eth0 -p tcp –dport 22 -j ACCEPT

## Всё остальное запретить
iptables -t filter -A INPUT -j DROP

Is closing ports and filtering out broadcast and local packets not enough? I heard that you also need to filter fragmented icmp packets and something else. Tell me what is missing.

Answer 1

The question is somehow incorrectly asked. What tasks does the server perform? What are the risks?
You can do without a firewall at all in some cases, for that matter, it’s enough just not to “shine” extra ports outward by correctly setting the listen directive in the services / services configs.

Answer 2

The question is not entirely correct, as already said. What in general should the server do, in addition to looking at the Internet around the clock? Does anyone have to go to it? Who, where, where (in the sense, what server services to use)? On the other hand, allowing any traffic from within the network in our difficult times is also quite frivolous. If you are already afraid of an attack from the outside, where is the guarantee that the local machine will not be attacked first, and then your server through it?
And a lot depends on the distribution. Every popular distro has recommendations to increase its own security - google for "distro hardening|securing"

Answer 3

Don't use a script!
Use iptables-save, iptables-restore.
In the case of using the script, you will lose the network for a couple of minutes when adding a new rule.