Server rental store

Firewall Ruleset

# Firewall Ruleset

This article details the firewall ruleset configured for our MediaWiki servers. Understanding these rules is crucial for both system administrators and developers deploying custom extensions or modifications. This document focuses on the current configuration as of MediaWiki 1.40, running on Debian 11 ("Bullseye"). Incorrectly configured firewall rules can lead to service disruptions or security vulnerabilities. This guide assumes a basic understanding of networking and firewall concepts. Please refer to the System Administration page for general server information.

Overview

Our firewall utilizes `iptables`, a user-space utility program that allows a system administrator to configure the tables of the Linux kernel firewall. We employ a stateful firewall approach, tracking connections and only allowing established, related, or explicitly permitted traffic. The rules are structured to minimize the attack surface while ensuring necessary services function correctly. We regularly review and update these rules based on security audits and evolving threats. See the Security Policy for more information.

Core Ruleset

The following table summarizes the core ruleset applied to the server. These rules are applied in order, and the first matching rule determines the action.

Chain Rule Number Action Protocol Port(s) Source Destination Comment
INPUT 1 ACCEPT TCP 22 Any Server IP Allow SSH access (restricted to specific IPs - see SSH Access Control)
INPUT 2 ACCEPT TCP 80 Any Server IP Allow HTTP access
INPUT 3 ACCEPT TCP 443 Any Server IP Allow HTTPS access
INPUT 4 ACCEPT TCP 53 Any Server IP Allow DNS queries (outgoing)
INPUT 5 ACCEPT TCP 25 Any Server IP Allow SMTP (outgoing) for system alerts
INPUT 6 ACCEPT RELATED,ESTABLISHED Any Any Any Allow established connections and related traffic
INPUT 7 DROP Any Any Any Drop all other incoming traffic

These rules are configured using a script located at `/etc/iptables.rules` and loaded at boot time via `systemd`. Changes to this script require a restart of the `iptables` service: `sudo systemctl restart iptables`. Always test changes in a staging environment before applying them to production. See Deployment Procedures for details.

Specific Service Rules

Beyond the core rules, specific services require additional firewall considerations. For example, MediaWiki relies on PHP-FPM to process requests. The following table details the rules pertaining to PHP-FPM.

Service Protocol Port(s) Source PHP-FPM TCP 9000 localhost

This rule allows communication between the web server (Apache) and PHP-FPM on the local machine. Restricting access to localhost is crucial for security. Similarly, our database server (MariaDB) has its own set of rules, documented in the Database Configuration article.

Output Rules

While the INPUT chain is most critical for security, the OUTPUT chain also plays a role. We primarily allow all outgoing traffic, but log potentially suspicious activity.

Chain Rule Number Action OUTPUT 1 ACCEPT All traffic is generally allowed outbound.

However, we log outgoing connections to port 25 (SMTP) to monitor for potential spam or unauthorized email activity. This logging is configured using `iptables` logging capabilities and analyzed by our security information and event management (SIEM) system. See Log Analysis for more details.

Monitoring and Maintenance

Regularly reviewing firewall logs is essential for identifying potential security incidents. We use tools like `fail2ban` to automatically block IP addresses exhibiting malicious behavior. See Fail2ban Configuration for more information. Furthermore, we perform periodic security audits to ensure the firewall ruleset remains effective. The Incident Response Plan outlines procedures for handling security breaches.

Related Pages

⚠️ *Note: All benchmark scores are approximate and may vary based on configuration. Server availability subject to stock.* ⚠️

View full article | Back to Server rental store