Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In preparation to eventually launch my first website, I've been playing with Ubuntu Lucid Server in a VM on my WinXP machine. I've been alternating between the Linode and Slicehost tutorials/articles for guidance, and I'm trying to make sense of the section on iptables.

Slicehost's example can be found here. It seems deceptively simple to me, though. It's just a matter of locking down everything and punching very specific holes. When all other articles seem confusing and make iptables sound like a huge PITA, this example seems very straightforward (or at least, it seems that way once you know what the commands mean).

Is this example suitable for a production server? Do the really complicated bits of iptables only really come up later?

share|improve this question
add comment

1 Answer 1

Depends vastly on your needs. iptables can be quite easy to master, when you understand how it works.

There are three chains in the filter table that contain rules: INPUT, OUTPUT and FORWARD. If you're wishing to block only packets coming into your server, then the INPUT chain is all you really need to be concerned about.

After that, it's just setting the appropriate criteria for what you want to block or how you want to handle connections. Just remember that when you're reading the rules, it's based on first-match, which means that if a packet matches a rule before the one you actually want, it will obey that first rule. So, order is important.

Generally, for basic INPUT filters, you'll find only a few holes punched for the services that are important, then a global catch-all that blocks everything else. The example Slicehost gives is a good example of this.

share|improve this answer
    
Awesome. So would the Slicehost example be good enough for production on a mundane LAMP site? The more advanced tutorials left me feeling like I was missing out on something important, though my reading of the Slicehost example looked fine to my layman eyes. –  AgentConundrum Aug 19 '10 at 10:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.