Server rental store

Firewall

# Firewall Configuration for MediaWiki Servers

This article details firewall configuration best practices for servers hosting a MediaWiki 1.40 installation. A properly configured firewall is critical for protecting your wiki from unauthorized access and malicious attacks. This guide is intended for system administrators and those new to server security.

Understanding Firewalls

A firewall acts as a barrier between your server and the outside world. It examines incoming and outgoing network traffic and blocks anything that doesn't match your defined rules. For a MediaWiki server, the firewall needs to allow legitimate traffic (primarily web requests on ports 80 and 443) while blocking everything else. Different firewall solutions exist, including `iptables`, `firewalld`, and cloud provider firewalls (like AWS Security Groups or Azure Network Security Groups). This article will focus on general principles applicable to most firewalls, with some examples leaning towards `iptables` as it's common on Linux systems. See System Administration for general server management.

Essential Ports for MediaWiki

MediaWiki relies on several ports for its operation. Understanding these is crucial when configuring your firewall.

Port Protocol Description
80 TCP Standard HTTP web traffic. Required for unencrypted access.
443 TCP Secure HTTPS web traffic. Highly recommended for security. See HTTPS Configuration
22 TCP SSH access for remote administration. Restrict access to trusted IPs onlySee Secure Shell (SSH)
3306 TCP MySQL/MariaDB database connection. Only allow access from the MediaWiki server itself. See Database Configuration
53 UDP/TCP DNS resolution. Usually handled by your system's DNS resolver.

It's essential to *only* expose the ports necessary for external access. Leaving unnecessary ports open increases your attack surface. Consider Security Best Practices for a more comprehensive overview.

Basic Firewall Configuration (iptables Example)

The following examples demonstrate using `iptables` to configure a basic firewall. These are *examples* and should be adapted to your specific server setup and security requirements. **Always test firewall changes in a non-production environment first**

First, it's good practice to set default policies to deny all incoming and forward traffic.

```bash iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT ```

Then, allow established and related connections:

```bash iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT ```

Finally, allow SSH (from a specific IP address), HTTP, and HTTPS. Replace `your.ip.address` with your actual IP address.

```bash iptables -A INPUT -p tcp --dport 22 -s your.ip.address -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT ```

These rules will block all incoming traffic *except* that specifically allowed. Remember to save your `iptables` rules so they persist after a reboot. The method for saving rules varies depending on your Linux distribution (e.g., `iptables-save > /etc/iptables/rules.v4` on Debian/Ubuntu). Consult your distribution's documentation. See Linux System Administration for more details.

Advanced Firewall Considerations

Beyond the basics, consider these advanced features:

⚠️ *Note: All benchmark scores are approximate and may vary based on configuration. Server availability subject to stock.* ⚠️

View full article | Back to Server rental store