Server rental store

Firewall Configuration

Firewall Configuration

A robust firewall configuration is essential for the security of any MediaWiki installation. This article provides a comprehensive guide to configuring a firewall to protect your MediaWiki server. It assumes a basic understanding of networking concepts like IP addresses, ports, and firewall rules. This guide will cover common approaches and best practices. We will focus on `iptables`, a common firewall utility on Linux systems, but the principles apply more broadly.

Understanding the Need for a Firewall

A firewall acts as a barrier between your server and the outside world. It examines incoming and outgoing network traffic and blocks anything that doesn't meet your defined rules. Without a firewall, your server is vulnerable to various attacks, including unauthorized access, data breaches, and denial-of-service (DoS) attacks. Properly configured firewalls are a cornerstone of Server Security. Consider using a Web Application Firewall (WAF) in addition to a standard firewall for enhanced protection against web-specific attacks. See Web Application Firewall for more information.

Common Ports Used by MediaWiki

MediaWiki relies on several ports for its operation. It's critical to understand these to correctly configure your firewall.

Port Protocol Description Common Use
80 TCP HTTP (Web) Standard web traffic for unencrypted connections.
443 TCP HTTPS (Secure Web) Secure web traffic for encrypted connections (strongly recommended). Requires SSL Certificate setup.
22 TCP SSH Remote server administration. Restrict access to trusted IP addresses.
3306 TCP MySQL/MariaDB Database communication. Typically only accessible from localhost. See Database Configuration.
53 UDP/TCP DNS Domain Name System. May be needed if the server also acts as a DNS server.

Setting up a Basic `iptables` Firewall

This section outlines a basic `iptables` configuration. Adapt these rules to your specific network environment. It’s crucial to test these rules on a non-production environment first before applying them to a live server. Incorrect firewall rules can lock you out of your server.

Important Note: These commands should be run as root or with sudo. Always back up your existing `iptables` configuration before making changes.

1. Flush Existing Rules:

```bash iptables -F iptables -X iptables -Z ```

2. Set Default Policies:

```bash iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT ```

This sets the default policy to drop all incoming and forwarded traffic, while allowing all outgoing traffic. This is a secure starting point.

3. Allow Established and Related Connections:

```bash iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT ```

This allows traffic related to existing connections, preventing issues with established connections being dropped. Refer to the Connection Tracking documentation.

4. Allow SSH Access (Restrict to Trusted IPs):

```bash iptables -A INPUT -p tcp --dport 22 -s -j ACCEPT ```

Replace `` with the IP address from which you will administer the server. Consider using a VPN for added security instead of directly exposing SSH. SSH Security is vital.

5. Allow HTTP and HTTPS Access:

```bash iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT ```

These rules allow access to the MediaWiki web interface.

6. Allow MySQL/MariaDB Access (Localhost Only):

```bash iptables -A INPUT -p tcp --dport 3306 -s 127.0.0.1 -j ACCEPT ```

This ensures only the local machine can access the database. See Database Security for more details.

7. Save the Rules:

The method for saving `iptables` rules varies depending on your distribution. On Debian/Ubuntu:

```bash apt-get install iptables-persistent netfilter-persistent save ```

On CentOS/RHEL:

```bash service iptables save ```

Advanced Firewall Considerations

Beyond the basic configuration, consider these advanced aspects:

⚠️ *Note: All benchmark scores are approximate and may vary based on configuration. Server availability subject to stock.* ⚠️

View full article | Back to Server rental store