I'd like to know if there's any holes/flaws in this firewall setup. I want to lock down the server as much as possible so it is impossible to hack in to. The only services running are openvpn and ssh.

# iptables example configuration script
# Flush all current rules from iptables
iptables -F

# Set default policies for INPUT, FORWARD and OUTPUT chains
iptables -P INPUT DROP                
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow SSH connections on tcp port 8888 
iptables -A INPUT -i venet0 -p tcp --dport 8888 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o venet0 -p tcp --sport 8888 -m state --state ESTABLISHED -j ACCEPT

# Set access for localhost
iptables -A INPUT -i lo -j ACCEPT

# Accept connections on 1194 for vpn access from client
iptables -A INPUT -i venet0 -p udp --dport 1194 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o venet0 -p udp --sport 1194 -m state --state ESTABLISHED -j ACCEPT

# Apply forwarding for OpenVPN Tunneling
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -j ACCEPT     
iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source   
iptables -A FORWARD -j REJECT

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# List rules
iptables -L -v
  • 2
    No. Well, just answering the question in the title. There is no completely secure anything. It would be more secure if you dropped all packets. HHOS ;)
    – d-_-b
    Apr 28 '11 at 7:56
  • Even then it's not 100% secure. The only way to secure it 100% is to disconnect it, and store it in a bank vault.
    – Majenko
    Apr 28 '11 at 8:41
  • 1
    And even then, it's not 100% secure. Security is not a destination, it's a process. You need to have procedures in place to constantly review the condition of your server... monitor logs, etc. Even this is only preventative. Personally, I feel the best course of action is to assume that your server will be compromised, and put plans in place to quickly and effectively detect and mitigate the compromise, rather than building walls that will have little effect in reality.
    – gerryk
    Apr 28 '11 at 8:52
  • 4
    "The only truly secure computer is one buried in concrete, with the power turned off and the network cable cut."
    – user1686
    Apr 28 '11 at 8:53
  • @grawity what if it was a laptop with wifi and a charged battery with a bios set to turn it on at a specific time. Still not secure ;)
    – Keltari
    Jan 12 '15 at 20:34

No. No firewall is completely secure. As long as there is a single port open you are vulnerable to attack.

It is, however, about as secure as you can make it given the circumstances.

It's good to see you're running SSH on a different port to standard.

If the computer is connected to the Internet then it cannot be 100% un-hackable. If there is a flaw in OpenVPN or SSH then an attacker could still gain access through those means. And, the firewall is only as strong as the passwords used on the protocols you pass through that firewall.

Make sure you have really strong passwords. Even better - don't just rely on passwords, but rely on a combination of password and key, so if someone does get your password it's not going to do them much good. And maybe restrict where you're allowing the connections to SSH and OpenVPN to come from - stop any connections from places like China, North Korea, etc.

  • There could be an issue in the kernel iptables code which allows for exploitation. If you are "lucky", that could allow someone to break in even with empty rulesets with all policies set to DROP.
    – user
    Oct 31 '15 at 15:21

You may want to restrict the ip ranges, from which you can reach ssh (and maybe openvpn). Make sure to add at least one range, where you know you will have access to even when your provider switches the subnet from which your ip comes. If you have another server, add its ip. You may even consider only allowing ssh from such an jump host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.