Learning about iptables: Is this Slicehost example any good?

Question

In preparation to eventually launch my first website, I've been playing with Ubuntu Lucid Server in a VM on my WinXP machine. I've been alternating between the Linode and Slicehost tutorials/articles for guidance, and I'm trying to make sense of the section on iptables.

Slicehost's example can be found here. It seems deceptively simple to me, though. It's just a matter of locking down everything and punching very specific holes. When all other articles seem confusing and make iptables sound like a huge PITA, this example seems very straightforward (or at least, it seems that way once you know what the commands mean).

Is this example suitable for a production server? Do the really complicated bits of iptables only really come up later?

Answer 1

Depends vastly on your needs. iptables can be quite easy to master, when you understand how it works.

There are three chains in the filter table that contain rules: INPUT, OUTPUT and FORWARD. If you're wishing to block only packets coming into your server, then the INPUT chain is all you really need to be concerned about.

After that, it's just setting the appropriate criteria for what you want to block or how you want to handle connections. Just remember that when you're reading the rules, it's based on first-match, which means that if a packet matches a rule before the one you actually want, it will obey that first rule. So, order is important.

Generally, for basic INPUT filters, you'll find only a few holes punched for the services that are important, then a global catch-all that blocks everything else. The example Slicehost gives is a good example of this.