I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection".
My iptables look like this:
*filter # Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0 -A INPUT -i lo -j ACCEPT -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT # Accepts all established inbound connections -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allows all outbound traffic -A OUTPUT -j ACCEPT # Allows HTTP and HTTPS connections from anywhere -A INPUT -p tcp --dport 80 -j ACCEPT -A INPUT -p tcp --dport 443 -j ACCEPT # Allows SSH connections on port 22 -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT # Allow ping -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT # log iptables denied calls -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 # Reject all other inbound - default deny unless explicitly allowed policy -A INPUT -j REJECT -A FORWARD -j REJECT COMMIT
Note, take the comments with a grain of salt, since they might be wrong.
My firewall will only allow traffic on 80/443, except when I VPN into my private network (which will give me access to 22).
- Are there any things that concern you about these iptables rules?
- Can my ASA-5510 likely provide more comprehensive protection then these rules?
- Given a secure firewall, what are the most obvious/common attack vectors that remain (aside from DoS and application layer security - I'm primarily concerned with a lower-level breach)? I ask because it seems like no matter what you do, somebody will find a way in, and I'm curious to know what some of those ways might likely stem from.