How to Set Up A Firewall Using Iptables on Ubuntu 16.04

Reading Time: 5 minutes

This guide will walk you through the steps for setting up a firewall using iptables in Ubuntu 16.04. We’ll show you some common commands for manipulating the firewall, and teach you how to create your own rules.

 

What are Iptables in Ubuntu?

The utility iptables is a Linux based firewall that comes pre-installed on many Linux distributions. It is a leading solution for software-based firewalls. It’s a critical tool for Linux system administrators to learn and understand. Any publicly facing server on the Internet should have some form of firewall enabled for security reasons. In a typical configuration, you would only open ports for the services that you wish to be accessible via the Internet. All other ports would remain closed and inaccessible via the Internet. For example, in a typical server, you may want to open ports for your web services, but you probably would not want to make your database accessible to the public!

 

Pre-flight

Working with iptables requires root privileges on your Linux box. The rest of this guide assumes you have logged in as root. Please exercise caution, as commands issued to iptables take effect immediately. You will be manipulating how your server is accessible to the outside world, so it’s possible to lock yourself out from your own server!

Note
If you’re a Liquid Web customer, check out our VPN + IPMI remote management solutions. These solutions can help you restore access to your server even if you’ve blocked out the outside world. We have a VPN configuration guide to get you started. Of course, our support staff is also standing by 24×7 in the event you get locked out.

 

How Do Iptables Work?

Iptables works by inspecting predefined firewall rules. Incoming server traffic is compared against these rules, and if iptables finds a match, it takes action. If iptables is unable to find a match, it will apply a default policy action. Typical usage is to set iptables to allow matched rules, and deny all others.

 

How Can I See Firewall Rules in Ubuntu?

Before making any changes to your firewall, it is best practice to view the existing rule set and understand what ports are already open or closed. To list all firewall rules, run the following command.

iptables -L

If this is a brand new Ubuntu 16.04 installation, you may see there are no rules defined! Here is an example “empty” output with no rules set:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

If you’re running Ubuntu 16.04 on a Liquid Web VPS, you’ll see we’ve already configured a basic firewall for you. There are usually three essential sections to look at in the iptables ruleset. When dealing with iptables rulesets, they are called “chains”, particularly “Chain INPUT”, “Chain FORWARD”, and “Chain OUTPUT”. The input chain handles traffic coming into your server while the output chain handles the traffic leaving your server. The forwarding chain handles server traffic that is not destined for local delivery. As you can surmise, the traffic is forwarded by our server  to its intended destination.

 

Common Firewall Configurations

The default action is listed in “policy”. If traffic doesn’t match any of the chain rules, iptables will perform this default policy action. You can see that with an empty iptables configuration, the firewall is accepting all connections and not blocking anything! This is not ideal, so let’s change this. Here is an example firewall configuration allowing some common ports, and denying all other traffic.

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p icmp -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -p tcp --dport 443 -j ACCEPT

iptables -A INPUT -p udp --dport 1194 -j ACCEPT

iptables -A INPUT -s 192.168.0.100 -j ACCEPT

iptables -A INPUT -s 192.168.0.200 -j DROP

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT ACCEPT

We will break down these rules one at a time.

iptables -A INPUT -i lo -j ACCEPT

This first command tells the INPUT chain to accept all traffic on your loopback interface. We specify the loopback interface with -i lo. The -j ACCEPT portion is telling iptables to take this action if traffic matches our rule.


iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Next, we’ll allow connections that are already established or related. This can be especially helpful for traffic like SSH, where you may initiate an outbound connection and wish to accept incoming traffic of the connection you intentionally established.


iptables -A INPUT -p icmp -j ACCEPT

This command tells your server not to block ICMP (ping) packets. This can be helpful for network troubleshooting and monitoring purposes. Note that the -p icmp portion is telling iptables the protocol for this rule is ICMP.


How Do I Allow a Port in Ubuntu?

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

TCP port 22 is commonly used for SSH. This command allows TCP connections on port 22. Change this if you are running SSH on a different port. Notice since SSH uses TCP, we’ve specified the protocol using -p tcp in this rule.


iptables -A INPUT -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -p tcp --dport 443 -j ACCEPT

These two commands allow web traffic. Regular HTTP uses TCP port 80, and encrypted HTTPS traffic uses TCP port 443.


iptables -A INPUT -p udp --dport 1194 -j ACCEPT

This is a less commonly used port, but here is an example of how to open port 1194 utilizing the UDP protocol instead of TCP. Note that in this example we’ve specified UDP by using -p udp.


How Do I Allow an IP Address in Ubuntu?

iptables -A INPUT -s 192.168.0.100 -j ACCEPT

You can configure iptables to always accept connections from an IP address, regardless of what port the connections arrive on. This is commonly referred to as “whitelisting”, and can be helpful in certain circumstances. We’re whitelisting 192.168.0.100 in this example. Typically you would want to be very restrictive with this action and only allow trusted sources.


How Do I Block an IP Address in Ubuntu?

iptables -A INPUT -s 192.168.0.200 -j DROP

You can also use iptables to block all connections from an IP address or IP range, regardless of what port they arrive on. This can be helpful if you need to block specific known malicious IPs. We’re using 192.168.0.200 as our IP to block in this example.


How Do I Block All Other Ports?

iptables -P INPUT DROP

Next, we tell iptables to block all other inputs. We’re only allowing a few specific ports in our example, but if you had other ports needed, be sure to insert them before issuing the DROP command.


How Do I Forward Traffic in Ubuntu?

iptables -P FORWARD DROP

Likewise, we’re going to drop forwarded packets. Iptables is very powerful, and you can use it to configure your server as a network router. Our example server isn’t acting as a router, so we won’t be using the FORWARD chain.


How Do I Allow All Outbound Traffic?

iptables -P OUTPUT ACCEPT

Finally, we want to allow all outgoing traffic originating from our server. We’re mostly worried about outside traffic hitting our server, and not blocking our own box from accessing the outside world.


How Do I Permanently Save IP Rules?

To make your firewall rules persist after a reboot, we need to save them. The following command will save the current ruleset:

/sbin/iptables-save


How Do I Reset My Iptable?

To wipe out all existing firewall rules and return to a blank slate, you can issue the following command. Remember that an empty iptables configuration allows all traffic to your server, so you typically would not want to leave your server unprotected in this state for very long. Nevertheless, this can be very helpful when configuring new firewall rulesets and you need to revert to a blank slate.

iptables -F

 

We’ve covered a lot of ground in this article! Configuring iptables can seem like a daunting process when first looking at an extensive firewall ruleset, but if you break down the rules one at a time, it becomes much easier to understand the process. When used correctly, iptables is an indispensable tool for hardening your server’s security. Liquid Web customers enjoy our highly trained support staff, standing by 24×7, if you have questions on iptables configurations. Have fun configuring your firewall!

What’s My IP Address?

Reading Time: 3 minutes

As part of our Web Hosting Toolkit, our Liquid Web IP Checker makes it easier than ever to identify IT issues. IP addresses are the unique numbers assigned to every computer that connects to the Internet. When troubleshooting connectivity issues, checking your computer’s IP address is the first step in identifying possible network issues. Correctly identifying your public IP address allows you (and our Support technicians) to find information on the server and it’s log files to pinpoint possible issues between your computer and server.

 

Finding Your Public IP Address

As the first piece of information in the connection between your local workstation and server, your Public IP address is critical to the information gathering process. Fortunately, you don’t need to navigate complex networking configurations on your computer to find the public IP address; you need to ask an external server what IP identifies with your connection. You can do this by using Liquid Web’s Internet Web Hosting Toolkit. Go to the toolkit website and click on IP Checker. You’ll immediately be shown the public IP address that your computer is reporting.

You can also get additional information about how your computer is identifying itself (including location, operating system, and browser details) by clicking on the link in the extra information area. This information can help identify website compatibility issues based on various user settings.

How Do I Know If My IP Is Public or Private?

Most computers that are attached to a network have both a Public and a Private IP address. The IP address assigned to your computer by your router or wireless modem is generally a Private IP and typically is in one of two “reserved” ranges: either 10.x.x.x or 192.x.x.x. These Private IP ranges allow all of the devices in your local network to communicate with each other. When connecting with devices outside of your local network, your router will provide a Public IP address to outgoing traffic (often all of the devices inside your network will “share” the same Public IP address). The Public IP address allows computers across the Internet to identify each other and communicate effectively. To troubleshoot networking issues, we’ll need to find the Public IP address that your computer is broadcasting to the Internet. With the Public IP you can search through the firewall and server logs to find connection attempts and identify possible issues that may be preventing access.

 

How Do I Know If MY IP Address Is Blocked?

Most servers have software that works to detect and prevent possible malicious activity. Sometimes this software is part of the firewall or another application, but the result is the same: computers that fail to satisfy this software will be blocked from accessing the server. These blocks can occur due to repeated failed login attempts or even by opening too many connections at the same time (this often happens when transferring a large amount of data via FTP).

Security software typically blocks IPs by an escalating scale. That is, an offending IP address will be blocked for a short amount of time on the first offense, but the blocks will increase in length as the behavior continues until the IP address is permanently barred. An incorrect password saved in an FTP client can result in a permanent block in a short amount of time. If you suspect your server is blocking your IP, you may be able to remove the block automatically. For more information on unblocking your IP, see Unblocking Your IP Address.

Now that you’ve got your Public IP address, you can check your server logs for failed connection attempts or other errors that may indicate why you are having trouble connecting. Or you can share that information with one of Liquid Web’s Most Helpful Humans in Hosting and they can help resolve whatever connectivity issues you are experiencing.

How Do I Use Liquid Web’s Hosting Toolkit?

Reading Time: 2 minutes

If there is one truth in the world of web hosting, it is that we always need more information. Information about configurations, servers, connections, delivery speeds and networking is essential in troubleshooting and optimizing our web presence. While this kind of information can be gathered from various providers and sites across the Internet, Liquid Web has developed a one-stop shop toolkit to gather some of the most vital troubleshooting tools in one convenient interface designed to make your life easier.

The Liquid Web Internet Webhosting Toolkit provides you with the data you need to verify connectivity, identify DNS issues, and test web page performance. We’ll continue to develop and share new tools that will make your job easier; it’s one of the ways that we are working to be the Most Helpful Humans in Hosting. Continue reading “How Do I Use Liquid Web’s Hosting Toolkit?”

Troubleshooting: Locked Out of RDP

Reading Time: 3 minutes

How Do I Get Back Into RDP?

You may be working from a local machine that has an IP that is not scoped on that RDP port, making it impossible for you to gain remote access to add the IP address to the RDP rule’s scope. Do not fret; there is a simple and quick way to add your IP to the RDP scoping (or any others entities such as MySQL or MSSQL) right through your Plesk interface in your local browser. Continue reading “Troubleshooting: Locked Out of RDP”

An Introduction to Firewalld

Reading Time: 5 minutes

In some ways, firewalld on systemd systems is easier to manage and configure than iptables. There are, for the most part, no long series of chains, jumps, accepts and denies that you need to memorize in order to get firewalld up and running in a basic configuration. The rules are simple and straightforward, but there is no reason you cannot still have all the power that iptables afforded. Continue reading “An Introduction to Firewalld”

Useful Command Line for Linux Admins

Reading Time: 11 minutes

The command line terminal, or shell on your Linux server, is a potent tool for deciphering activity on the server, performing operations, or making system changes. But with several thousand executable binaries installed by default, what tools are useful, and how should you use them safely? Continue reading “Useful Command Line for Linux Admins”

Improving Security for your Remote Desktop Connection

Reading Time: 4 minutes

Remote Desktop Protocol (RDP) is the easiest and most common method for managing a Windows server. Included in all versions of Windows server and has a built-in client on all Windows desktops. There are also free applications available for Macintosh and Linux based desktops. Unfortunately, because it is so widely used, RDP is also the target of a large number of brute force attacks on the server. Malicious users will use compromised computers to attempt to connect to your server using RDP. Even if the attack is unsuccessful in guessing your administrator password, just the flood of attempted connections can cause instability and other performance issues on your server. Fortunately, there are some approaches you can use to minimize your exposure to these types of attacks. Continue reading “Improving Security for your Remote Desktop Connection”

Whitelisting in ModSecurity

Reading Time: 6 minutes

Broken down into two parts our article’s first section hits on “how to whitelist IPs or URIs,” for people who are somewhat familiar with ModSecurity but want to know further about the process. Our second section examines why we configure ModSecurity and how to prevent the security of the server from getting in the way of our work. If you have a Fully Managed Liquid Web server reach out to our Heroic Support team for assistance with whitelisting! Continue reading “Whitelisting in ModSecurity”

Difference Between ipv4 and ipv6

Reading Time: 4 minutes

The Internet Protocol (IP) system designates how networked devices can address one another across the internet. The first major version of IP, IPv4, was deployed to the public ARPANET in 1983. IPv4 uses 4 one byte segments to designate a devices address, this 32-bit address space allows for 232 addresses to be used in total. The next major iteration of IP is called IPv6 and it uses a 128-bit address space allowing for significantly more IP addresses to be assigned. Continue reading “Difference Between ipv4 and ipv6”