Firewall

Note

this site belongs to the IP/network firewall. There is also a web application firewall within the Website service

Default settings

By default, all incoming and outgoing traffic is blocked, except:

related or established connections
ICMP/ICMPv6
Traceroute
SSH
outgoing connections to the following common services
- HTTP(S): TCP Ports 80, 443
- SMTP(S): TCP Ports 25, 587, 465
- POP3(S): TCP Ports 110, 995
- IMAP(S): TCP Ports 143, 993

Note

depending on your companys guideline, outgoing connections might not be allowed by default

Disable common outgoing services

To enhance the security level of your server, disable outgoing connections to common services by adding the following custom JSON configuration:

{
  "base::firewall::allow_outgoing_ports": false
}

Custom rules trough service

Where applicable, all services will add the firewall rules required automatically, for example:

website module will allow incoming HTTP(S)
ftp module will allow incoming FTP

Custom rules

Where applicable, both IPv4 and IPv6 Rules are added by default (for example INPUT chains for a particular port).

Configuration

Hint

this service as based on the official Puppet firewall module. For further configuration details, see the firewall documentation on Github

chain

INPUT for incoming rules
OUTPUT for outgoing rules

action

accept: The packet is accepted.
reject: The packet is rejected with a suitable ICMP response.
drop: The packet is dropped.

source (optional)

IPv4 source address or network. Examples:

192.168.0.1
192.168.0.0/24

source6 (optional)

IPv6 source address or network. Examples:

2001:db8::1
2001:db8::/32

destination (optional)

IPv4 destination address or network. Examples:

192.168.0.1
192.168.0.0/24

destination6 (optional)

IPv6 destination address or network. Examples:

2001:db8::1
2001:db8::/32

sport

Source port number.

dport

Destination port number.

proto

Protocol. Examples:

tcp
udp

Examples

Allow outgoing

{
  "base::firewall::rules": {
    "021 accept outgoing smtp to mailrelay": {
      "action": "accept",
      "chain": "OUTPUT",
      "destination": "192.168.0.1",
      "destination6": "2001:db8::1",
      "dport": "25"
    }
  }
}

Deny incoming

You can add custom rules to deny services, too:

{
  "base::firewall::rules": {
    "020 deny HTTP from evil network": {
      "action": "reject",
      "chain": "INPUT",
      "source": "192.168.0.0/24",
      "source6": "2001:db8::/32",
      "dport": "80"
    }
  }
}

Debugging

Logged in as user devop, you can diagnose created rules and logs trough the following means:

Firewall logs in /var/log/messages
show created rules with iptables-list or iptables-rules