How to set up IPTABLE the first time?

Question

linux

There is knowledge of Linux, but not a solid five. We set the task to close all ports on the Debian server, and 3306 and 22 - to allow them only for certain IPs. What and how to execute commands via SSH so that the connection is not closed? The server is remote, in distant overseas lands.

Answer 1

In short:
First you allow incoming to port 22 from a specific address and allow all outgoing
Then you close all incoming ones on all ports
After that, the connection should not fall off
After that, you allow incoming ones at the necessary addresses and ports:

iptables -A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp -m tcp -s <некоторый IP> --dport 22 -j ACCEPT

And so on.
After allowing the necessary incoming ports, you can close outgoing ports in the same way.
You can write all this into a script, and set the cron to clean up tables every 15 minutes in case something goes wrong.

Answer 2

in short so. you take a manual on iptable and you read. then you set up on a test stand. then again and again. and then already somewhere in the Far Far Away kingdom. then the first time.

Answer 3

Everyone advises using iptables , but I advise you to look at FERM , there is such a package in debian.
In fact, this is a convenient add-on for iptables with some features, for example, if you specify incorrect settings and lose connection with the server, ferm will roll them back ( --interactive key) There is a
lot of documentation on ferm, for example: habrahabr.ru/post/127184

Answer 4

Come up with some kind of rollback mechanism:
1) restart the computer after 15 minutes, and during these 15 minutes, drive in the rules in turn
2) apply the default iptables-apply or iptables-restore configuration also after 15 minutes

Answer 5

Don't bother with mogzk and get the rules generator for iptables, I really like firehol, it's simple and reliable! firehol.org
Here is an example config for pptp and LAN with masquerading and open required ports

interface eth0 mylan
    policy accept

interface ppp+ internet
    server smtp accept
    server http accept
    server ftp  accept
    server ssh  accept src example.firehol.org

    client all  accept

router mylan2internet inface eth0 outface ppp+
    masquerade
    route all accept

Answer 6

3306 is the port for MySQL. Whether it is closed or open - it does not matter at all for SSH access.
And for SSH it is not necessary to use 22. You can use any free one. Change it, and then experiment with 22 as you like.