Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'd like to know if there's any holes/flaws in this firewall setup. I want to lock down the server as much as possible so it is impossible to hack in to. The only services running are openvpn and ssh.

#!/bin/sh
#
# iptables example configuration script
#
# Flush all current rules from iptables
#
iptables -F

#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
iptables -P INPUT DROP                
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

#
# Allow SSH connections on tcp port 8888 
#
iptables -A INPUT -i venet0 -p tcp --dport 8888 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o venet0 -p tcp --sport 8888 -m state --state ESTABLISHED -j ACCEPT

#
# Set access for localhost
#
iptables -A INPUT -i lo -j ACCEPT

#
# Accept connections on 1194 for vpn access from client
#
iptables -A INPUT -i venet0 -p udp --dport 1194 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o venet0 -p udp --sport 1194 -m state --state ESTABLISHED -j ACCEPT

#
# Apply forwarding for OpenVPN Tunneling
#
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT     
iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source 69.147.244.199   
iptables -A FORWARD -j REJECT

#
# Enable forwarding
# 
echo 1 > /proc/sys/net/ipv4/ip_forward

#
# List rules
#
iptables -L -v
share|improve this question
    
No. Well, just answering the question in the title. There is no completely secure anything. It would be more secure if you dropped all packets. HHOS ;) –  d-_-b Apr 28 '11 at 7:56
    
Even then it's not 100% secure. The only way to secure it 100% is to disconnect it, and store it in a bank vault. –  Majenko Apr 28 '11 at 8:41
    
And even then, it's not 100% secure. Security is not a destination, it's a process. You need to have procedures in place to constantly review the condition of your server... monitor logs, etc. Even this is only preventative. Personally, I feel the best course of action is to assume that your server will be compromised, and put plans in place to quickly and effectively detect and mitigate the compromise, rather than building walls that will have little effect in reality. –  gerryk Apr 28 '11 at 8:52
4  
"The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut." –  grawity Apr 28 '11 at 8:53
add comment

1 Answer

No. No firewall is completely secure. As long as there is a single port open you are vulnerable to attack.

It is, however, about as secure as you can make it given the circumstances.

It's good to see you're running SSH on a different port to standard.

If the computer is connected to the Internet then it cannot be 100% un-hackable. If there is a flaw in OpenVPN or SSH then an attacker could still gain access through those means. And, the firewall is only as strong as the passwords used on the protocols you pass through that firewall.

Make sure you have really strong passwords. Even better - don't just rely on passwords, but rely on a combination of password and key, so if someone does get your password it's not going to do them much good. And maybe restrict where you're allowing the connections to SSH and OpenVPN to come from - stop any connections from places like China, North Korea, etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.