Firewall

UFW#

Configuration#

sudo ufw default deny incoming
sudo ufw default allow outgoingbash

To allow incoming connections:

sudo ufw allow ssh
sudo ufw allow "WWW Full"bash

To delete a rule:

sudo ufw delete allow 80bash

To check the status of UFW:

sudo ufw statusbash

Enable UFW:

sudo ufw enablebash

To list available applications:

sudo ufw app listbash

Fail2ban#

Configuration#

Copy the configuration file to prevent it from being overwritten during an update:

cd /etc/fail2ban
cp jail.conf jail.localbash

Edit the jail.local file:

# List of ignored IP addresses or DNS hosts
ignoreip = 127.0.0.1/8 ::1

# Ban Time
bantime = 2h

# Time between each ban
findtime = 20m

# Number of failures before a ban
maxretry = 6bash

To enable jails, create a jail-d.conf file in the /etc/fail2ban/jail.d directory and add the jail name with the value True. Example with ssh and apache2 jails:

[sshd]
port = 2222
enabled = true

[apache-auth]
enabled = truebash

List of Commands#

# Display status of active jails
fail2ban-client status

# Display status of a specific active jail
fail2ban-client status sshd

# Unban an IP address
fail2ban-client unban 1.2.3.4

# Unban an IP address from a specific service
fail2ban-client set sshd unban 1.2.3.4bash

Iptables#

Configuration#

Copy the list of iptables rules to the file /root/firewall.sh, modify them, and make it executable:

curl -L https://git.io/JeSL5 > /root/firewall.sh
chmod +x /root/firewall.shbash

Test and verify the execution of the script:

bash /root/firewall.sh
iptables -Lbash

Make the rules non-volatile:

iptables-save > /etc/firewall.confbash

Open /etc/network/if-up.d/iptables and add the following:

#!/bin/bash
iptables-restore < /etc/firewall.confbash

Make it executable:

chmod +x /etc/network/if-up.d/iptablesbash

Administration#

Change the rules:

vim /root/firewall.sh
bash /root/firewall.sh
iptables-save > /etc/firewall.confbash

See the forbidden IP addresses from the banip.txt file:

iptables -L INPUT -nv --line-numbers | grep DROPbash

See the banned IP addresses of ipset:

ipset -Lbash

Create a banip.txt file and add the IPs to ban manually.