How to Secure Your Linux Server with iptables Firewall

As a Linux system administrator, securing your servers should be a top priority. One of the most powerful tools at your disposal for locking down your Linux machines is iptables – the built-in Linux firewall. In this comprehensive guide, we will explore how to utilize iptables to establish robust firewall rules that restrict access to your services and strengthen your server security.

Overview of iptables

iptables is the default firewall included in Linux kernel distributions. It allows administrators to define rules for handling network traffic that reaches your server. With iptables, you can:

• Filter traffic based on protocols, IP addresses/subnets, port numbers etc.
• Restrict connections to only those you explicitly allow
• Log or drop invalid packets to prevent attacks
• Nat (Network Address Translation) traffic to mask private IP ranges
• Set up stateful firewall rules that track connection state

iptables consists of a set of ordered rules split between various tables, with each table serving a specific purpose:

• Filter – Contains rules to allow/block traffic and perform actions like logging, dropping packets etc.
• Nat – Rules for network address translation reside here.
• Mangle – Used for specialized packet alteration.
• Raw – Used mainly for configuring exemptions from connection tracking.

The filter table is the most commonly used, as that is where access control policies for services reside.

Why iptables Firewall Matters for Security

While Linux servers run very little unnecessary services by default, ensuring your attack surface is minimized is vital for security.

Some key benefits of leveraging iptables properly include:

1. Restricting network access to only intended services

By default all ports are accessible externally on a Linux server. iptables allows whitelisting just the specific destination ports you need to expose. All other services can be completely blocked from public access.

2. Protection from reconnaissance and attacks

Malicious actors are constantly scanning for open ports and vulnerable services. A filtered iptables configuration helps mask open ports, blocking access to latent vulnerabilities.

3. Prevention of abuse from compromised services

In the event an application facing the public internet has a vulnerability that gets exploited, iptables rules can contain the damage, preventing access to other services on the server.

4. Logging and analysis for threat detection

iptables can log invalid traffic which is useful for detecting scans, connection floods and other malicious activity. These firewall logs feed into security information and event management (SIEM) systems to analyze traffic patterns and improve incident response.

Clearly, directly exposed services benefit greatly from iptables protection. But even servers inside private networks should adopt firewall best practices in case an attacker penetrates the perimeter of your infrastructure.

Key Principles for iptables Firewall Policies

Before diving into the specifics of iptables syntax, there are some overarching principles that will guide construction of sound firewall policies:

Default Deny Stance

Iptables rules are processed sequentially from top to bottom. The default policy if no rules match is to allow traffic. However, we want to explicitly allow only the minimum ports and protocols required, denying everything else by default. This prevents incorrect rules or typos from accidentally opening access.

Stateful Inspection

Tracking the state of connections to distinguish legitimate traffic from suspicious patterns provides significant protection. Rules utilizing state modules offer better protection compared to basic allow/deny filters.

Least Privilege Access

Each service/process should only be granted the narrowest scope of access required for functioning. This containment approach limits what an attacker can access if they compromise a service.

Immutable Infrastructure

Firewall policies should be defined in code (e.g Terraform/Ansible scripts) rather than interactively. This allows version controlling rules, testing policies before deploying, and rebuilding systems easily into a known secure state.

With these principles established as guidelines, let‘s explore implementing security hardening with iptables.

Getting Started with iptables Firewall Rules

To start manipulating firewall policies, we will need to use the iptables command with appropriate arguments and syntax:

iptables [-t table] command [match] [target/jump]

The key components include:

Table – Specifies which table to apply the rule to (filter, nat etc). Filter table is used if unspecified.

Command – Adds, deletes or lists existing rules. Common ones are:

• -A (append): Add rule
• -D (delete): Remove rule
• -L (list): Print all rules
• -F (flush): Delete all rules

Match – Defines matching criteria like protocol, IP address and port

Target/Jump – Specifies the action if match criteria is met (e.g accept, drop, reject, log etc)

Additionally the -P flag sets the default policy of the table (e.g DROP all non-matching packets)

Let‘s explore some practical examples to better understand iptables syntax.

Listing and Flushing Rules

To print existing rules in the filter table:

iptables -L

To delete all rules and start fresh:

iptables -F
iptables -X (delete user defined chains) 
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT 

This clears out all chains in the filter table and sets defaults to allow all traffic.

Adding/Deleting Rules

Allow TCP traffic on port 80:

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

Remove the rule again:

iptables -D INPUT -p tcp --dport 80 -j ACCEPT

Saving iptables Rules

iptables configurations get wiped when the server is restarted. To persist rules and load them on reboot:

/etc/sysconfig/iptables (Redhat/CentOS)

*filter
:INPUT ACCEPT [0:0]  
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp --dport 80 -j ACCEPT 
COMMIT

/etc/iptables/iptables.rules (Debian/Ubuntu)

*filter
:INPUT ACCEPT
:FORWARD ACCEPT 
:OUTPUT ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT
COMMIT

Let‘s build on these basics to harden security step-by-step.

Step 1 — Restricting Access To Services

Our first goal is to restrict network access to only the intended services that need to be publicly reachable:

Set default deny firewall policy

iptables -P INPUT DROP
iptables -P FORWARD DROP

This will block all incoming+forwarded packets by default.

Allow essential system traffic

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp --icmp-type any -j ACCEPT
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

• Allow all traffic related to established connections (important for stateful services to receive replies)
• Permit local traffic on loopback interface
• Allow ping for troubleshooting
• Drop invalid packets that fail state tracking

Whitelist specific services

If we have a web server, SMTP mail and SSH server that need to be reached:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT      
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

This allows only our required destination ports, blocking everything else incoming.

We haven‘t defined any OUTPUT policies, so responses to inbound allowed traffic are still permitted. We want to ensure legitimate replies are sent out while restricting outgoing connections.

Step 2 — Restricting Outbound Traffic

Putting egress rules in place is important to contain malware and prevent data exfiltration in case of an intrusion.

Set default outbound policy to DROP

iptables -P OUTPUT DROP

Permit all established connections

iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT 

This allows all replies related to incoming connections we have explicitly allowed.

Allow essential system traffic

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type any -j ACCEPT

Permit ping replies and loopback interface traffic.

Only allow new connections for critical updates

To retain the ability to install security patches/updates:

iptables -A OUTPUT -p tcp -d repo1.mycorp.com --dport 80 -m conntrack --ctstate NEW -j ACCEPT
iptables -A OUTPUT -p tcp -d repo2.mycorp.com --dport 80 -m conntrack --ctstate NEW -j ACCEPT 

Here we selectively permit new outbound connections to internal repo servers. By allowing only known update repositories, we prevent new arbitrary connections getting established.

Log all denied traffic

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A OUTPUT -j LOGGING 

iptables -A LOGGING -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP

This will log all dropped input/output packets to syslog up to 5 packets per minute. Custom log prefix added for easy identification. Logging denied traffic is crucial to detect attacks and suspicious traffic patterns.

At this point access to services is restricted by whitelist, and new connections tightly controlled based on least privilege. Next we will build on stateful firewall rules and add further protections.

Step 3 — Stateful Firewall Rules

Stateful firewalling is a key advantage iptables policies have over basic allow/deny filters.

Some key benefits include:

• Automatic handling of related inbound+outbound packets
• Ability to segment TCP sessions into states
• Tracking connections made to unauthorized ports
• Built-in DOS/DDoS protections

Let‘s explore some stateful modules and protections that can be layered on top of our existing iptables configuration.

Limit Connections Per Source

Restrict max connections per IP to prevent DoS attacks:

iptables -A INPUT -p tcp --syn -m connlimit --connlimit-above 10 --connlimit-mask 32 -j REJECT

This allows only 10 simultaneous TCP connections from a single IP, throttling brute force attacks. The --connlimit-mask represents the number of bits of the IP address to apply the limit to.

Require Established Connections

Adding this very restrictive rule ensures only established sessions in response to our whitelist rules are permitted, blocking everything else new:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

New outbound connections must match our update repository rules to succeed, severely limiting attack surface.

Segment Connection States

Track and filter based on TCP session state:

iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP  

iptables -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j ACCEPT

iptables -A INPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT

• NEW – First packet sent to initiate TCP handshake (drop)
• SYN – Only let new SYN packets destined for our whitelist rules
• ESTABLISHED – Permit all subsequent packets for accepted streams

This provides granular control over handshake and connection states to thwart attacks.

Time-Based Rules

Restrict access only during maintenance window:

iptables -A INPUT -p tcp --dport 22 -m time --timestart 9:00 --timestop 17:00 --weekdays Mon,Tue,Wed,Thu,Fri -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

Allow SSH only during work hours on weekdays, denying outside that time window.

Rate Limit Traffic

Throttle HTTP connections per IP to mitigate DOS attacks:

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 50 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp --syn --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

Limits SYN packets – allowing 25 new connections per minute per IP, with bursts of 100 at a time. This ensures quality of service for legitimate users while imposing throttling measures.

As you can see, stateful firewall policies provide a rich feature set of timing, throttling and connection tracking functionality that offers robust protection far beyond basic allow/deny filtering.

Additional iptables Tips

Here are some additional useful iptables tips:

Include comments

Makes rules more readable:

-A INPUT -s 192.168.1.0/24 -j DROP # block internal traffic

Rule counters

Counts packets/bytes matched per rule:

iptables -L -v

Group rules

Keeps config modular:

iptables -N SERVER1 
iptables -A SERVER1 -d 10.1.1.1 -j ACCEPT

iptables -A INPUT -p tcp -d 10.1.1.1 -j SERVER1 

Packet marking

Tag and filter packets:

iptables -t mangle -A PREROUTING -d 192.168.0.1 -j MARK --set-mark 42
iptables -t filter -A INPUT -m mark --mark 42 -j ACCEPT

Conclusion

Firewalls are the frontline of infrastructure security. Iptables provides feature-rich native protection for Linux environments without needing dedicated firewall appliances. It takes time to fully grasp the nuances, but the effort is well worth it.

Implementing least privilege whitelists, state tracking, threat detection and limiting lateral movement equips you to lock down servers to the minimum exposure necessary. Combine iptables firewall hardening with other security best practices like system hardening, patch management and intrusion detection – and you are well along the path of establishing robust security around your Linux infrastructure with minimal cost.