Skip to content

presentation.md

Latest commit

 

History

History
306 lines (196 loc) · 5.96 KB

presentation.md

File metadata and controls

306 lines (196 loc) · 5.96 KB

Firewalls in Virtual Private Servers

A comprehensive guide to managing firewalls

Introduction to Firewalls

  • A firewall is a network security device that monitors and controls incoming and outgoing network traffic
  • Firewalls act as a barrier between trusted internal networks and untrusted external networks
  • For VPS, firewalls are crucial in protecting against unauthorized access and potential cyber threats

Types of Firewalls

Network-based firewalls:

- Operate at the network level
- Filter traffic between networks

Host-based firewalls:

- Installed on individual servers or devices
- Control traffic in and out of a single host

Firewall Functionality

Packet filtering:

Examines packets and allows/blocks based on predefined rules

Stateful inspection:

Monitors the state of active connections and makes decisions based on context

Application layer filtering:

Analyzes specific application-level protocols

Common Firewall Rules

Inbound traffic:

Controls access to your VPS from external sources

Outbound traffic:

Manages connections initiated from your VPS to external destinations

Allow rules:

Permit specific types of traffic

Deny rules:

Block specific types of traffic

Firewall Best Practices for VPS

Implement a default deny policy:

Block all traffic by default, then allow only necessary connections

Follow the principle of least privilege:

Grant minimal access required for each service or user

Conduct regular audits and updates:

Review rules periodically and keep firewall software up-to-date

Popular Firewall Solutions for VPS

UFW (Uncomplicated Firewall):

Simple, user-friendly firewall for Ubuntu and Debian-based systems

FirewallD:

Dynamic firewall manager for CentOS, Fedora, and RHEL systems

IPTables:

Powerful, low-level firewall tool available on most Linux distributions

Introduction to UFW

UFW (Uncomplicated Firewall) is a user-friendly frontend for managing iptables

Advantages of UFW:

 - Simple command-line interface
 - Easy to configure and manage
 - Suitable for both beginners and advanced users

UFW Basic Commands

Installation:

sudo apt install ufw

Enabling UFW:

sudo ufw enable

Disabling UFW:

sudo ufw disable

Checking status:

sudo ufw status

# or

sudo ufw status verbose

UFW Rule Management

Adding rules:

sudo ufw allow PORT/PROTOCOL # protocol is optional

sudo ufw deny PORT/PROTOCOL # protocol is optional

Deleting rules:

sudo ufw delete <rule>

Listing rules:

sudo ufw status numbered

UFW Demo: Basic Configuration

# Enable UFW
sudo ufw enable

# Allow SSH (port 22)
sudo ufw allow 22/tcp

# Allow HTTP (port 80)
sudo ufw allow 80/tcp

# Allow HTTPS (port 443)
sudo ufw allow 443/tcp

# Check status
sudo ufw status

UFW Demo: Advanced Rules

# Allow specific IP address
sudo ufw allow from 192.168.1.100

# Allow specific IP range
sudo ufw allow from 192.168.1.0/24 to any port 3306

# Rate limiting
sudo ufw limit 22/tcp

# Deny outgoing traffic to a specific IP
sudo ufw deny out to 203.0.113.0/24

Introduction to FirewallD

FirewallD is a dynamic firewall manager that uses zones and services for configuration

Advantages of FirewallD:

  - Runtime and permanent configuration options
  - Support for network zones
  - Dynamic rule updates without breaking existing connections

FirewallD Concepts

- Zones: Sets of rules that specify the traffic allowed based on the level of trust
- Services: Predefined rules for allowing traffic for specific network services
- Ports: Individual port or port range configurations

FirewallD Rule Management

Adding services:

sudo firewall-cmd --add-service=<service> # https/ssh/http/ftp etc

Removing services:

sudo firewall-cmd --remove-service=<service>

Opening ports:

sudo firewall-cmd --add-port=<port>/<protocol>

Closing ports:

sudo firewall-cmd --remove-port=<port>/<protocol>`

Working with zones:

sudo firewall-cmd --zone=<zone> --add-service=<service>`

FirewallD Demo: Basic Configuration

# Start and enable FirewallD
sudo systemctl start firewalld
sudo systemctl enable firewalld

# Allow SSH
sudo firewall-cmd --add-service=ssh --permanent

# Allow HTTP and HTTPS
sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --add-service=https --permanent

# Reload to apply changes
sudo firewall-cmd --reload

FirewallD Demo: Advanced Configuration

# Create a new zone
sudo firewall-cmd --new-zone=myzone --permanent

# Add a specific IP to the zone
sudo firewall-cmd --zone=myzone --add-source=192.168.1.100 --permanent

# Allow MySQL in the new zone
sudo firewall-cmd --zone=myzone --add-port=3306/tcp --permanent

# Set up port forwarding
sudo firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080 --permanent

# Reload to apply changes
sudo firewall-cmd --reload

Comparing UFW and FirewallD

Ease of use:

- UFW: Simpler syntax, easier for beginners
- FirewallD: More complex, but offers greater flexibility

Flexibility:

- UFW: Straightforward rule management
- FirewallD: Advanced features like zones and runtime configurations

Performance:

- Both offer good performance, with FirewallD having a slight edge in complex setups

Best Practices

- Choose the right firewall based on your VPS distribution and needs
- Regularly maintain and update your firewall rules
- Implement logging and monitoring to detect potential security issues
- Always use the principle of least privilege when configuring firewall rules
- Combine firewall protection with other security measures for comprehensive VPS security