Solved

Linux firehol/iptables on server

Posted on 2010-11-10
4
650 Views
Last Modified: 2012-05-10
Hi,

I have been looking different firewalls for Linux Centos 5.5 and have decided that firehol will be the easiest way to implement iptables.
However I need help configuring it. This is my senario...

I have a (physical) server sitting in a datacenter, it has one Ethernet network connection (to the internet). The server will be running VoIP for around 20 businesses so I want to restrict access to the server based on IP addresses as well as ports, as all the customers will have static IP Addresses.
So only authorized customers will be able to access the server and then only to authorized ports.

How would I accomplish this using iptables and firehol?

Thanks
0
Comment
Question by:mark_06
4 Comments
 
LVL 26

Expert Comment

by:jar3817
ID: 34102075
Just skip firehol and edit the /etc/sysconfig/iptables file directly to build your firewall. For example:

-A INPUT -s <source IP here> -m state --state NEW -m tcp -p tcp --dport <tcp port here> -j ACCEPT

Please don't take this the wrong way, but if you don't know linux basics like iptables, you have no business hosting phone services to other businesses. Voice is a mission critical application, you REALLY need to know what you're doing when providing a service like that. Imagine if there is an emergency and people can't dial 911 because you didn't configure something right...
0
 
LVL 16

Accepted Solution

by:
Blaz earned 500 total points
ID: 34105207
I normally use iptables direclty but if you minsist on using firehol then the sintax should be something like:
interface eth0 internet
      server <service_name>  accept src "IP1 IP2 IP3 ..."

service_name is your service if found on list: http://firehol.sourceforge.net/services.html. Otherwise you have to define it: http://firehol.sourceforge.net/adding.html

You will probably also accept some ssh traffic from your IP and other
0
 
LVL 6

Author Comment

by:mark_06
ID: 34108800
Hi jar3817, I understand where you are coming from regarding Linux. A project like this is a team effort, not a one man job. I am a Cisco man myself I would consider myself an expert on VoIP, it's just linux isn't my platform. I am  working on this with another person who is a Linux guru, however he is away for a few weeks and I don't want to wait for him to get back before I start internal testing, but then I don't want to make the server live without restricting access to it.

Thanks for your suggestions guys I will give them a go!
0
 
LVL 4

Expert Comment

by:AbhisekSanyal
ID: 34110552
Hi,
  I would suggest using Shorewall. It has a simple configuration syntax and is well supported by the community.
0

Featured Post

Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

786 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question