Basic configuration of iptables for VPS Security

Basic configuration of iptables for VPS Security

I have read the secure log and access log, and most of them are brute force cracking and scanning. Although the password of my brother is extremely complicated, it is not a problem to consume server resources, simply change the ssh port and ftp, and write an iptables file to slightly protect it. Another thing is Fail2Ban, which can automatically detect brute-force cracking. If the password is incorrect more than a certain number of times, ban the peer end. However, I really don't want to open another service, it should not be a problem to change the port...

It's just the most basic configuration. I'm too lazy to defend against flood. If someone has a hatred against me and wants to defend against DDOS attacks, forget it...

# Configure, disable inbound, Allow outbound, and allow loopback Nic
Iptables-P INPUT DROP
Iptables-P OUTPUT ACCEPT
Iptables-a input-I lo-j ACCEPT
# Ping is allowed, and deletion is not allowed.
Iptables-a input-p icmp-j ACCEPT
# Allow ssh
Iptables-a input-p tcp-m tcp -- dport 22-j ACCEPT
# Allow ftp
Iptables-a input-p tcp-m tcp -- dport 20-j ACCEPT
Iptables-a input-p tcp-m tcp -- dport 21-j ACCEPT
# Allow the range of ftp passive interfaces, which can be set in the ftp configuration file
Iptables-a input-p tcp -- dport 20000:30000-j ACCEPT
# Learn felix and set smtp to local
Iptables-a input-p tcp-m tcp -- dport 25-j ACCEPT-s 127.0.0.1
Iptables-a input-p tcp-m tcp -- dport 25-j REJECT
# Allow DNS
Iptables-a input-p tcp-m tcp -- dport 53-j ACCEPT
Iptables-a input-p udp-m udp -- dport 53-j ACCEPT
# Allow http and https
Iptables-a input-p tcp-m tcp -- dport 80-j ACCEPT
Iptables-a input-p tcp-m tcp -- dport 443-j ACCEPT
# Allow status detection, too lazy to explain
Iptables-a input-p all-m state -- state ESTABLISHED, RELATED-j ACCEPT
Iptables-a input-p all-m state -- state INVALID, NEW-j DROP

# Save Configuration
Iptables-save>/etc/iptables

After saving it, Debian does not need to make iptbles a service separately. For details about how to enable iptables to automatically load upon startup, see the article "Implementation of Automatic loading of iptables firewall at Debian startup".

I wrote the above and below sections into sh, start {}and stop {}. It is better to clear and recreate the rules directly when you need to modify the rules, because the rules have order problems.

# Clear configurations
Iptables-F
Iptables-X
Iptables-Z
Iptables-P INPUT ACCEPT
Iptables-P OUTPUT ACCEPT