{"id":358,"date":"2010-02-25T15:44:33","date_gmt":"2010-02-25T13:44:33","guid":{"rendered":"http:\/\/www.shukko.com\/x3\/2010\/02\/25\/howto_quick_n_dirty_iptables-based_firewall-for-your-openvz-based-vps\/"},"modified":"2010-02-25T15:44:33","modified_gmt":"2010-02-25T13:44:33","slug":"howto_quick_n_dirty_iptables-based_firewall-for-your-openvz-based-vps","status":"publish","type":"post","link":"https:\/\/www.shukko.com\/x3\/2010\/02\/25\/howto_quick_n_dirty_iptables-based_firewall-for-your-openvz-based-vps\/","title":{"rendered":"HOWTO:_Quick_n&#8217;_Dirty_IPTables-Based_Firewall &#8212; For your OpenVZ based VPS"},"content":{"rendered":"<h1>Abstract<\/h1>\n<p>The following is a Quick n&#8217; Dirty method at implementing a very simple firewall. This HOWTO is a general compilation of suggested tips for a firewall.<\/p>\n<h1>Let&#8217;s Get Dirty<\/h1>\n<h3>Locate IPTables<\/h3>\n<p>Depending on your VPS, first locate iptables:<\/p>\n<pre>[root@vps \/]# which iptables\r\n<\/pre>\n<h3>Create IP Based Accept\/Deny<\/h3>\n<p>Create a whitelist (IP passes through firewall) or blacklist (packets from IP always dropped) if you wish:<\/p>\n<pre>[root@vps \/]# vi \/usr\/local\/etc\/whitelist.txt\r\n<\/pre>\n<p>And\/Or&#8230;<\/p>\n<pre>[root@vps \/]# vi \/usr\/local\/etc\/blacklist.txt\r\n<\/pre>\n<p>In each file, add each IP per line, for instance:<\/p>\n<pre>4.2.2.2\r\n66.35.15.20\r\n<\/pre>\n<h3>firewall.sh Script<\/h3>\n<p>Then put the following in \/etc\/init.d\/firewall.sh, and edit to fit your needs:<\/p>\n<pre>#!\/bin\/sh\r\n#\r\n## Quick n Dirty Firewall\r\n#\r\n## List Locations\r\n#\r\n\r\nWHITELIST=\/usr\/local\/etc\/whitelist.txt\r\nBLACKLIST=\/usr\/local\/etc\/blacklist.txt\r\n\r\n#\r\n## Specify ports you wish to use.\r\n#\r\n\r\nALLOWED=\"22 25 53 80 443 465 587 993\"\r\n\r\n#\r\n## Specify where IP Tables is located\r\n#\r\n\r\nIPTABLES=\/sbin\/iptables\r\n\r\n#\r\n## Clear current rules\r\n#\r\n\r\n$IPTABLES -F\r\necho 'Clearing Tables F'\r\n$IPTABLES -X\r\necho 'Clearing Tables X'\r\n$IPTABLES -Z\r\necho 'Clearing Tables Z'\r\n\r\necho 'Allowing Localhost'\r\n#Allow localhost.\r\n$IPTABLES -A INPUT -t filter -s 127.0.0.1 -j ACCEPT\r\n\r\n#\r\n## Whitelist\r\n#\r\n\r\nfor x in `grep -v ^# $WHITELIST | awk '{print $1}'`; do\r\n        echo \"Permitting $x...\"\r\n        $IPTABLES -A INPUT -t filter -s $x -j ACCEPT\r\ndone\r\n\r\n#\r\n## Blacklist\r\n#\r\n\r\nfor x in `grep -v ^# $BLACKLIST | awk '{print $1}'`; do\r\n        echo \"Denying $x...\"\r\n        $IPTABLES -A INPUT -t filter -s $x -j DROP\r\ndone\r\n\r\n#\r\n## Permitted Ports\r\n#\r\n\r\nfor port in $ALLOWED; do\r\n        echo \"Accepting port TCP $port...\"\r\n        $IPTABLES -A INPUT -t filter -p tcp --dport $port -j ACCEPT\r\ndone\r\n\r\nfor port in $ALLOWED; do\r\n        echo \"Accepting port UDP $port...\"\r\n        $IPTABLES -A INPUT -t filter -p udp --dport $port -j ACCEPT\r\ndone\r\n\r\n$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n$IPTABLES -A INPUT -p udp -j DROP\r\n$IPTABLES -A INPUT -p tcp --syn -j DROP\r\n<\/pre>\n<h3>Start Firewall<\/h3>\n<pre>[root@vps \/]# chmod 700 \/etc\/init.d\/firewall.sh\r\n[root@vps \/]# \/etc\/init.d\/firewall.sh\r\n<\/pre>\n<p><!-- Saved in parser cache with key wiki_vpslink:pcache:idhash:1417-0!1!0!0!!en!2 and timestamp 20100225060022 --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Abstract The following is a Quick n&#8217; Dirty method at implementing a very simple firewall. This HOWTO is a general compilation of suggested tips for a firewall. Let&#8217;s Get Dirty Locate IPTables Depending on your VPS, first locate iptables: [root@vps \/]# which iptables Create IP Based Accept\/Deny Create a whitelist (IP passes through firewall) or [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-358","post","type-post","status-publish","format-standard","hentry","category-kategerisiz"],"_links":{"self":[{"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/posts\/358","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/comments?post=358"}],"version-history":[{"count":0,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/posts\/358\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/media?parent=358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/categories?post=358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/tags?post=358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}