iptables is not always easy to deal with so I prefer to use Uncomplicated firewall (ufw) in Ubuntu, because it simplifies configuring and maintaining my firewall rules.
Unfortunately, ufw does not play nice with OpenVZ containers so I decided to find something else. In the end (after testing various things) I decided to install the package
iptables-persistent which is not as sexy as ufw but gets the job done.
iptables-persistent uses two configuration files
both files can be generated during installation.
The a simple version of
/etc/iptables-persistent/rules.v4 may look like this
*filter # Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0 -A INPUT -i lo -j ACCEPT -A INPUT -i ! lo -d 127.0.0.0/8 -j DROP # Allow all traffic from tun-devices (VPN) -A INPUT -i tun+ -j ACCEPT # Accepts all established inbound connections -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allows all outbound traffic # You could modify this to only allow certain traffic # This is in addition to allowing established and related traffic as listed above -A OUTPUT -j ACCEPT # Allows HTTP and HTTPS connections from anywhere (the normal ports for websites) -A INPUT -p tcp --dport 80 -j ACCEPT -A INPUT -p tcp --dport 443 -j ACCEPT # Allows SSH connections from trusted-host only - drop the rest -A INPUT -p tcp --dport 22 -s 126.96.36.199 -j ACCEPT # Allow ping -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT # log iptables denied calls -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 # Drop all other inbound - default deny unless explicitly allowed policy (change to REJECT of you which to reject packets instead of dropping them) -A INPUT -j DROP -A FORWARD -j DROP COMMIT
After making changes to your rules files, apply them by running
$ sudo service iptables-persistent reload