ISPConfig 3 : What is the best Firewall / IPtables config ? (after install on Debian 8)

Hi
I follow your the good tutorial to install ISPconfig : The Perfect Server – Debian 8 Jessie (Apache2, BIND, Dovecot, ISPConfig 3) but I have some questions about iptables config.

==> What is the best IPTABLES config after install ISPconfig ? for a simple web server (dns / apache / local mysql) with 2/3 websites ?
==> Can you help me to configure ? (For example I see MySQL port open with distant nmap and that is no good)
Thanks.

My current ISPCONFIG SERVICES :

Code:

Web-Server:    Online
FTP-Server:    Online
SMTP-Server:    Online
POP3-Server:    Online
IMAP-Server:    Online
DNS-Server:    Online
mySQL-Server:    Online

My current IPTABLES CONFIG :

Code:

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
fail2ban-postfix-sasl  tcp  --  anywhere             anywhere             multiport dports smtp
fail2ban-pureftpd  tcp  --  anywhere             anywhere             multiport dports ftp
fail2ban-dovecot-pop3imap  tcp  --  anywhere             anywhere             multiport dports pop3,pop3s,imap2,imaps
fail2ban-ssh  tcp  --  anywhere             anywhere             multiport dports ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        

Chain fail2ban-dovecot-pop3imap (1 references)
target     prot opt source               destination        
RETURN     all  --  anywhere             anywhere           

Chain fail2ban-postfix-sasl (1 references)
target     prot opt source               destination        
RETURN     all  --  anywhere             anywhere           

Chain fail2ban-pureftpd (1 references)
target     prot opt source               destination        
RETURN     all  --  anywhere             anywhere           

Chain fail2ban-ssh (1 references)
target     prot opt source               destination        
RETURN     all  --  anywhere             anywhere       

NMAP OPEN PORT TEST

Code:

 ~  nmap -T4 -F XXX.XXX.XXX.XXX

Starting Nmap 7.12 ( https://nmap.org ) 
Nmap scan report for
Host is up (0.054s latency).
Not shown: 85 closed ports
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
80/tcp   open     http
110/tcp  open     pop3
143/tcp  open     imap
443/tcp  open     https
465/tcp  open     smtps
587/tcp  open     submission
993/tcp  open     imaps
995/tcp  open     pop3s
3306/tcp open     mysql
8080/tcp open     http-proxy
8081/tcp open     blackice-icecap

Nmap done: 1 IP address (1 host up) scanned in 1.39 seconds

 

Literally all ports are open considering you haven't specified a REJECT rule in your INPUT chain (the default policy ACCEPT is used if no matching rule is encountered), therefore all inbound connections are accepted.

To accomodate the use of conntrack later on, we first have to setup a rule to allow ESTABLISHED connections:

Code:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

After that, add a REJECT rule at the end of the INPUT chain:

Code:

iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

Do the same for the FORWARD chain:

Code:

iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited

Since you have no rules specified at all, this will close all ports. I recommend to add an additional chain for your services:

Code:

iptables -N SERVICES

Refer to it in your INPUT chain (Note: the line number supplied is dependant on the rules present in your INPUT chain, if you have modified your INPUT chain in the mean time, adjust this number accordingly, it must come before the REJECT rule):

Code:

iptables -I INPUT 6 -j SERVICES

Start adding your services to the SERVICES chain (replace port 80 with whatever service you want to open):

Code:

iptables -A SERVICES -p tcp -m conntrack --ctstate NEW -m tcp --dport 80 -j ACCEPT

Without saving, all rules will be lost after an iptables restart (reboot), to save the rules issue the following command:

Code:

service iptables save

If your server is IPv6 enabled, repeat the process for your ip6tables.