I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection".

My iptables look like this:


#  Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d -j REJECT

#  Accepts all established inbound connections

#  Allows all outbound traffic

# Allows HTTP and HTTPS connections from anywhere
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#  Allows SSH connections on port 22
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly allowed policy


Note, take the comments with a grain of salt, since they might be wrong.

My firewall will only allow traffic on 80/443, except when I VPN into my private network (which will give me access to 22).

  1. Are there any things that concern you about these iptables rules?
  2. Can my ASA-5510 likely provide more comprehensive protection then these rules?
  3. Given a secure firewall, what are the most obvious/common attack vectors that remain (aside from DoS and application layer security - I'm primarily concerned with a lower-level breach)? I ask because it seems like no matter what you do, somebody will find a way in, and I'm curious to know what some of those ways might likely stem from.
  • 2
    Even the most secure firewalls have to allow traffic to a service running on a computer. Once access is allowed, then an attacker can find a way in by attacking the service itself. Firewalls only limit the amount of access an attacker has. – schroeder May 14 '13 at 15:14

Your iptables rules look generally fine to me, although I cannot spot how you are enforcing 22 from the VPN only (unless you have configured sshd to only listen on the VPN IP, which should be ok).

Also you can use POLICY (-P) rather than your bottom two rules, but either should be fine.

  • Thanks so much! Btw, 1) do you mean that "POLICY (-P)" at the bottom of my rules has the exact same effect? And, 2) (regarding VPN port 22). My understanding was that if I VPN into a private network, and SSH into my server, I'll be gaining access due to the fact that my firewall allows VPN traffic on port 22. My server is set up to not care either way (I have SSH "hardened"), but for added safety, port 22 traffic is not allowed on the public network. Did I state that all correctly, or is there a bigger picture I'm missing? Also, if iptables blocks a lot of requests, will my logs grow huge? – orokusaki May 14 '13 at 21:48
  • 1
    With iptables, the policy is the default action that a chain takes when no rules have been matched, so yeah it has the same effect as your final two rules. If port 22 is not forwarded to the outside world, then that is fine too. Given that iptables is behind the hardware firewall, I would say your logs will remain mostly empty. – lynks May 15 '13 at 6:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.