Difference between revisions of "Firewall INPUT filters"

Line 11: Line 11:
  
 
You can find the basics INPUT rules over here: [[Firewall core (main) protocols]]
 
You can find the basics INPUT rules over here: [[Firewall core (main) protocols]]
 +
  
 
=SSH=
 
=SSH=
Line 47: Line 48:
 
$IPTABLES -A OUTPUT -p tcp -m state -i eth0 --dport 8080 -j ACCEPT
 
$IPTABLES -A OUTPUT -p tcp -m state -i eth0 --dport 8080 -j ACCEPT
 
$IPTABLES -A OUTPUT -p tcp -m state -i eth0 --dport 8443 -j ACCEPT
 
$IPTABLES -A OUTPUT -p tcp -m state -i eth0 --dport 8443 -j ACCEPT
 +
</syntaxhighlight>
 +
 +
 +
=Application servers=
 +
 +
 +
<syntaxhighlight lang="bash">
 +
##### Input
 +
$IPTABLES -A INPUT -p tcp --dport 8080 -j ACCEPT  # HTTP alt.
 +
# JBoss wildfly
 +
$IPTABLES -A INPUT -p tcp --dport 9090 -j ACCEPT  # Wildfly administration
 +
# Glassfish
 +
$IPTABLES -A INPUT -p tcp --dport 4848 -j ACCEPT  # Glassfish4 administration manager
 +
$IPTABLES -A INPUT -p tcp --dport 1527 -j ACCEPT  # Glassfish4 security manager
 +
$IPTABLES -A INPUT -p tcp --dport 7676 -j ACCEPT  # Open MQ (bundled with Glassfish) - JMS broker
 +
 +
 +
##### Output
 +
$IPTABLES -A OUTPUT -p tcp --dport 8080 -j ACCEPT  # HTTP alt.
 +
# JBoss wildfly
 +
$IPTABLES -A OUTPUT -p tcp --dport 9090 -j ACCEPT  # Wildfly administration
 +
# Glassfish
 +
$IPTABLES -A OUTPUT -p tcp --dport 4848 -j ACCEPT  # Glassfish4 administration manager
 +
$IPTABLES -A OUTPUT -p tcp --dport 1527 -j ACCEPT  # Glassfish4 security manager
 +
$IPTABLES -A OUTPUT -p tcp --dport 7676 -j ACCEPT  # Open MQ (bundled with Glassfish) - JMS broker
 
</syntaxhighlight>
 
</syntaxhighlight>
  

Revision as of 19:41, 25 October 2014


INPUT view

Input filters


Basic inputs

You can find the basics INPUT rules over here: Firewall core (main) protocols


SSH

# SSH - max 3 connection request per minute
$IPTABLES -A INPUT -p tcp -m limit 3/min --limit-burst 3 --dport 22 -j ACCEPT


Web server

You have to open the following ports:

  • Port 80 = HTTP
  • Port 443 = HTTPS
$IPTABLES -A INPUT -p tcp -m state -i eth0 --dport 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp -m state -i eth0 --dport 443 -j ACCEPT


Tomcat (alt. HTTP)

You have to open the following ports:

  • Port 8080 = HTTP alt.
  • Port 8443 = HTTPS alt.
$IPTABLES -A INPUT -p tcp -m state -i eth0 --dport 8080 -j ACCEPT
$IPTABLES -A INPUT -p tcp -m state -i eth0 --dport 8443 -j ACCEPT

$IPTABLES -A OUTPUT -p tcp -m state -i eth0 --dport 8080 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m state -i eth0 --dport 8443 -j ACCEPT


Application servers

##### Input
$IPTABLES -A INPUT -p tcp --dport 8080 -j ACCEPT   # HTTP alt.
# JBoss wildfly 
$IPTABLES -A INPUT -p tcp --dport 9090 -j ACCEPT   # Wildfly administration
# Glassfish
$IPTABLES -A INPUT -p tcp --dport 4848 -j ACCEPT   # Glassfish4 administration manager
$IPTABLES -A INPUT -p tcp --dport 1527 -j ACCEPT   # Glassfish4 security manager
$IPTABLES -A INPUT -p tcp --dport 7676 -j ACCEPT   # Open MQ (bundled with Glassfish) - JMS broker


##### Output
$IPTABLES -A OUTPUT -p tcp --dport 8080 -j ACCEPT   # HTTP alt.
# JBoss wildfly 
$IPTABLES -A OUTPUT -p tcp --dport 9090 -j ACCEPT   # Wildfly administration
# Glassfish
$IPTABLES -A OUTPUT -p tcp --dport 4848 -j ACCEPT   # Glassfish4 administration manager
$IPTABLES -A OUTPUT -p tcp --dport 1527 -j ACCEPT   # Glassfish4 security manager
$IPTABLES -A OUTPUT -p tcp --dport 7676 -j ACCEPT   # Open MQ (bundled with Glassfish) - JMS broker


DHCP

This is how you enable a DHCP server with TFTP (netBoot) :

IPTABLES=`which iptables`
LAN_ADDRESS="172.16.50.0/24"

# Allow LAN communication
# ... Required for NFS and the NetBoot ...
$IPTABLES -A INPUT -s $LAN_ADDRESS -d $LAN_ADDRESS -m state ! --state INVALID -j ACCEPT
$IPTABLES -A OUTPUT -s $LAN_ADDRESS -d $LAN_ADDRESS -m state ! --state INVALID -j ACCEPT
 
########################
# INPUT filters
########################
 
##### DHCP client ######
# Broadcast IP request 
$IPTABLES -A OUTPUT -p udp -d 255.255.255.255 --sport 68 --dport 67 -j ACCEPT
# Send / reply to IPs requests
$IPTABLES -A INPUT -p udp -s 255.255.255.255 --sport 67 --dport 68 -j ACCEPT
 
###### DHCP server ######
# Received client's requests [udp + tcp]
$IPTABLES -A INPUT -p udp --sport 68 --dport 67 -j ACCEPT
$IPTABLES -A INPUT -p tcp --sport 68 --dport 67 -j ACCEPT

# NetBoot - TFTP server
$IPTABLES -A INPUT -p udp -s $LAN_ADDRESS --dport 69 -j ACCEPT
 
 
########################
# OUTPUT filters
########################
# DHCP [udp + tcp]
$IPTABLES -A OUTPUT -p udp --dport 67 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 67 -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 68 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 68 -j ACCEPT
 
# TFTP NetBoot 
$IPTABLES -A OUTPUT -p udp --dport 69 -j ACCEPT


Note the difference between the broadcast request that every computer should allow and the plain OUTPUT allow on ports 67,68 for the DHCP server !!


Don't forget to adjust your network number 172.16.50.0/24

LDAP

$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 389 -j ACCEPT # LDAP
$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 636 -j ACCEPT # LDAPS


NFS

It's really tricky to adjust the firewall for NFS as the port is dynamic. But option is to allow LAN traffic and use NFS over LAN only.


Sonar

You have to open the port 9000

$IPTABLES -A INPUT -p tcp -m state -i eth0 --dport 9000 -j ACCEPT

$IPTABLES -A OUTPUT -p tcp -m state -i eth0 --dport 9000 -j ACCEPT

best way is to use a proxy redirection. see: Sonar#Apache2 proxy