Question : We have one of our websites up and running on our Nautilus infrastructure in Stratos DC. Our security team has raised a concern that right now Apache's port i.e 8081 is open for all since there is no firewall installed on these hosts. So we have decided to add some security layer for these hosts and after discussions and recommendations we have come up with the following requirements:
1. Install iptables and all its dependencies on each app host.
2. Block incoming port 8081 on all apps for everyone except for LBR host.
3. Make sure the rules remain, even after system reboot.
1. At first login on App server ssh tony@stapp01
2. Switch to root user : sudo su -
3. Run Below command to install IPtables service
yum install -y iptables-services
4. Start & enable the IPtables service below commands
systemctl start iptables && systemctl enable iptables
5. Add below IPtables Rules as per your task ( Please check port no as per your task)
7. Finally saved the rules to ensure they remain persistent across reboot
8. For persistent across reboot restart IPtables service & validate
systemctl restart iptables && systemctl status iptables
9. Validate the task by listing Iptables Rules post restart services.
From LB server it should be reachable & accessible
Whereas form Jump server it should not be accessible
Happy Learning!!!!
13 Comments
If the above solution didn't work with recent iptables. Please try the following.
ReplyDelete---
iptable -I INPUT -s -p tcp --dport 5004 -j ACCEPT
---
In the latest iptables installation adding rules to the end will fail the task, as there are some default rules that rejects all the incoming calls with "reject-with icmp-host-prohibited".
You must add the accept rule to top of the INPUT rules.
Thanks Phoenix, Yes if any one face issue please apply rules suggested by Mr. Phoenix
DeleteI did just that and you guys marked me as wrong, and by the way, I've tested that on the lab, once you reboot the host you loose all the rules you've applied, to make it stick, for some reason, you need to issue chkconfig on iptables
Deleteyum install iptables-services -y
ReplyDeletesystemctl start iptables && systemctl status iptables
systemctl enable iptables
iptables -L
iptables -A INPUT -p tcp --destination-port 8086 -s 172.16.238.14 -j ACCEPT or iptables -A INPUT -p tcp -s 172.16.238.14 --dport 6400 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 8086 -j DROP
service iptables save
systemctl restart iptables
I am unable to access the port from LoadBalancer Server Please help me
Hi Akash, hope you have gone through the video below
Deletetry this additional rule to apply . save and restart the services
iptables -L --line-numbers
iptables -R INPUT 5 -p icmp -j REJECT
thank you!
Deletecan you tell me why this rule need added? its icmp protocol and we reject him. Why?
You welcome. as there are default rules that rejects all the incoming calls with "reject-with icmp-host-prohibited". to restrict for ICMP we change protocol from all to ICMP. If you have still have any queries feel free to connect me online chat support in working hours.
Deleteiptables -I INPUT 1 -p tcp --destination-port 8081 ! -s 172.16.238.14 -j REJECT
ReplyDeleteThanks PA for this one linear rule, but for beginner need to understand so kept simple
DeleteIf you can make a video, explaining the reason for your commands and IP's you have used, It would be much helpful.
ReplyDeleteThanks for your comment & suggestion. Sure will make note and try to explain the reason of commands in upcoming post. Meanwhile if you have any queries feel free to connect me for online support chat.
DeleteI am getting Error .
ReplyDelete- Apache service on APP Server 1 is not reachable from LB host
FAILED test_stlb01.py::test_stlb01 - AssertionError: - Apache service on App ...
I applied Steps as mentioned:
yum install -y iptables-services
systemctl start iptables
systemctl enable iptables
systemctl status iptables
iptables -A INPUT -p tcp --destination-port 3000 -s 172.16.238.14 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 3000 -j DROP
iptables -L --line-numbers
iptables -R INPUT 5 -p icmp -j REJECT
service iptables save
systemctl restart iptables
systemctl status iptables
systemctl restart httpd
Please make sure you using the correct port number as per your the task. rest all steps are correct. still if you have problem feel free to connect me online chat support
ReplyDelete