Enterprises often need servers to serve their clients across the world such as websites , databases or remote access servers. For example when you are viewing this site you are accessing my server’s public IP address on a specific port , most likely port 80. Therefore we are in desperate need to ensure we are server is secure and administrated in safe manner. The best way I can describe having port 80 open on a public IP address is like putting a nice donut on the open road but that donut is covered and secured by a glass box and you can only see it through a tiny hole. That tiny hole is port 80. Imagine how much people would try to break that glass and take that tasty donut especially in less safe areas. Therefore this article will teach you the most secure way to open a port using iptables.
What is a firewall?
A firewall is a network security device that monitors, filters, and controls incoming and outgoing network traffic[1]. The main purpose is to act as barrier between external networks and internal networks or any network in fact. It is often placed on critical areas such as between networks or routers. Moreover another type of firewall is a host-based firewall which is a software application installed directly on a single host to monitor and filter its inbound and outbound network traffic rather than a whole network [2]. Therefore the point is to simply prevent unauthorized incoming and outgoing traffic on hosts and networks to help secure them further. It is kind of like a border you do not need everyone coming in , you must be able to dicatate who comes in and who comes out to have a safe country , the same idea applies to a network. Iptables is a host based firewall application based on Linux systems. It has direct access to the net filter Linux kernel which is a separate post on its own which I intend to complete in the near future. For this post we will simply demonstrate how to secure a webserver using iptables leaving out the theory on
Practical application
It is best practice for every host to ensure that only authorized traffic is allowed on both incoming and outgoing connections. That means that iptables should default be on drop meaning all ports are closed by default and you open strictly the ports that are needed. For iptables we have three chains , the first chain deals with incoming connections this means connections that are entering your system. The second chain is the output chain which deals with all connections that are destined for machines on the outside. Lastly the the forward chain deals with any packet that is not destined to the host machine itself.
Setting up our webserver
First we must update our kali linux machine using the command:
sudo apt update -y
Secondly we must install the software which we will be using apache2
sudo apt install apache2
By default it is disabled meaning it is not running nor accessible to anyone to enable it run the command:
sudo systemctl enable apache2
Opening ports
Now from experience I know a webserver on apache2 uses port 80 and if configured it can also use port 443 to serve it’s clients on a secure connection. Therefore for this lab we will be using only port 80 and will be opening only this port. To allow others to access port 80 on our IP address we can use the following command
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo: Runs the command with root (administrator) privileges.
iptables: The built-in Linux administration tool for IPv4 packet filtering.
-A INPUT: Appends the new rule to the end of the specified chain (e.g., INPUT).
-p tcp: Matches packets using the TCP protocol.
--dport 80: Matches traffic targeting destination port 80 (standard HTTP).
-j ACCEPT: Tells the firewall to jump to the ACCEPT target, letting the traffic pass through.
Great! Now others can access our webserver on port 80 , however our default policy for iptables is to allow all traffic this can be quite dangerous if we have other services running like SSH that we did not intend the public to access.
Securing our webserver
It is best to understand your application to know what port it is using on both the input and output chain. We can use Wireshark ( a packet sniffing tool) to conduct such testing. We can know access it from another machine while sniffing for packets.
One important detail to analyze is that our webserver uses port 80 to send packets used to facilitate connections between the client and itself. This is because the client operating system The client operating system chooses a random ephemeral port between 49152 and 65535 for outbound connections. So our webserver will use port 80 to reply to our client. Now we can set our iptables to default drop all connections but allow only:
- Connections coming to our webserver via port 80
- Connections coming from our webserver to reply to the client on source port 80
We have already applied the 1st firewall rule , now we can apply the second one on the output chain and change it to source port instead of destination port.
sudo iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT
We can set our iptables default policy to drop all connections , this means only authorized traffic will be allowed into our machine and our webserver will also work , it is also good to allow localhost to work to prevent glitches , we can do this by:
iptables -A INPUT -i lo -j ACCEPT
Great our website works and it safe from all of those outsiders. Thanks for reading and have a great day.
[1] https://www.fortinet.com/resources/cyberglossary/firewall
