Setting up iptables (Linux Firewall) for ssh, syslog and internet access
This article has not been completed yet. However, it may already contain helpful Information and therefore it has been published at this stage.
# Install Net - Tools
sudo apt-get install net-tools
# Show active Ports
sudo netstat -tunlp
# Installing iptables
sudo apt-get install iptables
# Permission Evelation
sudo su
# Showing active rules
iptables -L -v
# Adding specific rules
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 514 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 514 -j ACCEPT
# Modifying the default output policy
sudo iptables -A OUTPUT -j ACCEPT
sudo iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Modifying the default input policy
sudo iptables -A INPUT -j DROP
# Showing active rules
iptables -L -v
# Saving iptables config
sudo /sbin/iptables-save
# Reset Config
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
# Flush & Delete all Rules
iptables -F
# Delete all Custom Chainss
iptables -X
Use of simplified administration by ufw (uncomplicated firewall)
# Disable ufw
sudo ufw --force disable
# Reset ufw
sudo ufw reset
sudo ufw --force reset
# Check ufw Status
sudo ufw status
# Allow All Outgoing Connections
sudo ufw default allow outgoing
# Deny All Incoming Connections
sudo ufw default deny incoming
# Allow SSH
sudo ufw allow ssh
# Allow SYSLOG
sudo ufw allow 514/tcp
sudo ufw allow 514/udp
# Enable ufw
sudo ufw enable
sudo ufw --force enable
# Show rules (with index)
sudo ufw status numbered
# Delete a specific rule
sudo ufw delete 2
# Reload Config
sudo ufw reload
# Clean up (ufw Deinstallation)
sudo apt-get purge ufw
References:
https://www.cyberciti.biz/tips/linux-iptables-4-block-all-incoming-traffic-but-allow-ssh.html