LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Help configuring VPS Server ( IPTABLES ) (https://www.linuxquestions.org/questions/linux-security-4/help-configuring-vps-server-iptables-4175583097/)

near88 06-26-2016 06:47 AM
Help configuring VPS Server ( IPTABLES )
 
Hello, I need help please.
I bought a VPS server, and I intend to use it as a server to OpenVas, but I want to set the following safety rules.

- Only able to access the VPS server using VPN connection, configuring iptables correctly.

OpenVAS ,access the server, if I'm first connected by VPN (port 9392)

SSH access to the server, only if I first connected by VPN.

Thank you very much!

lazydog 07-01-2016 10:33 AM
So you want this server to be accessed by VPN on port 9393? Once you are logged in to the VPN you are already past the firewall.
You just need to configure ssh to allow only connection from the vpn ip address range.

A simple firewall could look like the following;

Code:
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 9393 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
COMMIT
You might want to look at how to secure your VPN to ensure no one breaks in.

near88 07-01-2016 12:50 PM
Hi !
And i have want to Openvas , only can rules with VPN conection , how can i configure it ?

" gsad -mlisten=10.8.0.1 " ?

Thanks!!

near88 07-02-2016 02:41 AM
VPN port is 1194 , and openvas server is 9392

lazydog 07-02-2016 03:11 PM
Above is a start substitute the correct port number for what I have in --dport with what ever you have as your VPN port. This will allow you to VPN in.
Make sure your inside of the VPN uses RFC1918 address space and then you can add a rule that will only allow your internal space to connect to the OpenVAS port.

near88 07-04-2016 12:38 AM
Can you give me a sample of rule for only allow my internal space to connect to the OpenVAS por ( 9392 ) ? Thanks!:)

lazydog 07-05-2016 10:08 AM
sure if you are using 192.168.1.1/24 as an internal address space:

Code:
-A INPUT -p tcp -m conntrack --ctstate NEW -s 192.168.1.0/24 -m tcp --dport 9393 -j ACCEPT

near88 07-05-2016 10:13 AM
As an internal space adress i use 10.8.0.X ( I believe it ) How can i see it ?

9393 , or 9392 ? Thanks !! And sorry :(

lazydog 07-05-2016 10:58 AM
Is google broken for you?


All times are GMT -5. The time now is 01:52 AM.