To keep things succinct, the commands will be provided within a table format below following a brief precursor explanation on the various firewalls we’ll be covering here.

Common Firewalls Used in Linux

The following section covers basic background information regarding what firewall types are available within your Linux OS.

iptables

The Linux kernel requires rules for IP packet filtering to be managed in tables. iptables is used to set up, maintain, and inspect these tables of IP packet filtering rules with each table containing built-in chains. The iptables chains are lists of rules which match a set of packets, specifying instructions for each rule on how to handle the packet.

ConfigServer Security & Firewall (CSF)

ConfigServer Security & Firewall or CSF, is a tool that manipulates iptables chains while also providing additional functionality that iptables does not offer. CSF filtering is done on IP addresses, services, and ports.

CSF uses the Login Failure Daemon (lfd) which provides a tool that scans the latest log file entries for login attempts against your server. This is useful for detecting brute-force attacks, allowing lfd to automatically detect the pattern and block the offending IP.

Uncomplicated Firewall (UFW)

Uncomplicated Firewall (UFW) is the default firewall configuration tool for Ubuntu and has been developed to ease iptables firewall configuration by providing a friendly method to create an Ipv4 or Ipv6 host-based firewall.

Firewalld

Firewalld is a service daemon with D-bus interface which provides easy management of the network/firewall zones, assigning different levels of trust to a network and its associated connections. Additionally, the interface also provides the ability to add iptables rules directly.

Table of Commands for Firewall Management

The following is a list of common commands that can be made for the four the Firewall types discussed above.

The post Common Firewall Commands: Iptables, CSF, UFW, & Firewalld appeared first on Hivelocity Hosting.

The post Restrict clients using my SQL Server by their IP Address? appeared first on Hivelocity Hosting.

Ports that must be open to run cPanel behind a firewall:

port service protocol direction

20 ftp tcp inbound/outbound

21 ftp tcp,udp inbound/outbound

22 ssh tcp inbound

25 smtp tcp inbound/outbound

26 smtp tcp inbound/outbound

37 rdate tcp outbound

43 whois tcp outbound

53 DNS tcp/udp inbound/outbound
(inbound is only needed if you run your own public DNS server you)

80 http tcp inbound/outbound

110 pop3 tcp inbound

113 ident tcp outbound

143 imap4 tcp inbound

443 https tcp inbound

465 smtp tls/ssl tcp/udp inbound/outbound

873 rsync tcp/udp outbound

993 imap4 ssl tcp inbound

995 pop3 ssl tcp inbound

2082 cpanel tcp inbound

2083 cpanel ssl tcp inbound

2086 whm tcp inbound

2087 whm ssl tcp inbound

2089 cp licence tcp outbound

2095 Webmail tcp inbound

2096 Webmail SSL tcp inbound

3306 mysql tcp (only if you need to connect remotely)

6666 chat tcp inbound

The post What ports should be open if I’m running my cPanel server behind a firewall? appeared first on Hivelocity Hosting.

Short answer: No, it is not supported. It was once semi-possible to run cPanel behind a NAT firewall, however the system has changed somewhat so that if you use more than one server behind the NAT (more than one appears from behind the same public IP), the license server will lock the public IP out to prevent abuse. There are other technical problems such as virtual hosting with apache and domain->ip mapping, dns and so on that prevent us from supporting this method.

The post Can I run cPanel behind NAT? appeared first on Hivelocity Hosting.

Using netstat -a you can view a list of all open ports.

Using csf -l you can view all of the ports that CSF is utilizing.

The post Checking Which Ports Are Open When the Firewall Is Activated appeared first on Hivelocity Hosting.

Notes:
192.168.1.1 is the example base IP address of the server, You need to change this
192.168.1.2 is *your* IP address. You *must* change this otherwise you’ll lock yourself out of the server.
This example would be saved to file /etc/sysconfig/iptables
You need to load the ip_conntrack_ftp module into the kernel when iptables is started. You add this module name in /etc/rc.d/init.d/iptables
Change;
IPTABLES_MODULES=””
To;
IPTABLES_MODULES=”ip_conntrack_ftp”
################################################## #####
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
:BLOCK_NET – [0:0]
# Handle Passive FTP (remember to enable ip_conntrack_ftp module)
-A OUTPUT -p tcp -m tcp -m state –dport 1024:65535 –sport 1024:65535 –state RELATED,ESTABLISHED -j ACCEPT
# Server Base IP address
-A INPUT -s 192.168.1.1 -j ACCEPT
-A INPUT -i lo -j ACCEPT
# Management IPs (VERY IMPORTANT TO PUT YOUR IP HERE otherwise you’ll be locked out)
-A INPUT -s 192.168.1.2 -j ACCEPT
# End Management IPs
# Run Block bad networks chain
-A INPUT -j BLOCK_NET
# Handle Passive FTP (remember to enable ip_conntrack_ftp module in the iptables init script)
A INPUT -p tcp -m tcp -m state –dport 1024:65535 –sport 1024:65535 –state ESTABLISHED -j ACCEPT
-A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp –icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 20:21 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 53 -j ACCEPT
-A INPUT -p udp -m udp –dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 113 -j DROP
-A INPUT -p tcp -m tcp –dport 135 -j DROP
-A INPUT -p tcp -m tcp –dport 136 -j DROP
-A INPUT -p tcp -m tcp –dport 137 -j DROP
-A INPUT -p tcp -m tcp –dport 138 -j DROP
-A INPUT -p tcp -m tcp –dport 139 -j DROP
-A INPUT -p tcp -m tcp –dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 445 -j DROP
-A INPUT -p tcp -m tcp –dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 593 -j DROP
-A INPUT -p tcp -m tcp –dport 777 -j DROP
-A INPUT -p tcp -m tcp –dport 778 -j DROP
-A INPUT -p tcp -m tcp –dport 837 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 1025 -j DROP
-A INPUT -p tcp -m tcp –dport 1080 -j DROP
-A INPUT -p tcp -m tcp –dport 1434 -j DROP
-A INPUT -p tcp -m tcp –dport 1433 -j DROP
-A INPUT -p tcp -m tcp –dport 3128 -j DROP
-A INPUT -p tcp -m tcp –dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 4321 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 4444 -j DROP
-A INPUT -p tcp -m tcp –dport 5432 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 6667 -j DROP
-A INPUT -p tcp -m tcp –dport 8080 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 8443 -j ACCEPT
-A INPUT -p udp -m udp –dport 137:138 –sport 137:138 -j DROP
# Logging to /var/log/messages
-A INPUT -p tcp -m tcp -j LOG –log-prefix “AUDIT TCP “
-A INPUT -p tcp -m tcp -j REJECT –reject-with tcp-reset
-A INPUT -p udp -m udp -j LOG –log-prefix “AUDIT UDP “
-A INPUT -p udp -m udp -j REJECT –reject-with icmp-port-unreachable
-A INPUT -p icmp -m icmp –icmp-type 8 -j LOG
# mangle section
*mangle
REROUTING ACCEPT [1591876424:227299011220]
:INPUT ACCEPT [1591816598:227294667655]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1765890237:977040975279]
:POSTROUTING ACCEPT [1765890154:977040909847]COMMIT
# NAT section
*nat
PREROUTING ACCEPT [10032111:558215684]
:POSTROUTING ACCEPT [5152283:290989829]
:OUTPUT ACCEPT [3923347:241838349]
COMMIT
################################################## #####

The post Default IPTables Configuaration for HSphere appeared first on Hivelocity Hosting.

Note: Steps 1-3 are specifically for 2003 Service Pack1, rest are for both 2000 and 2003 machines.

Go to Start => Run=>DComcnfg => Component Services => My Computer => Properties => COM Security =>

Access Permissions =>Edit Limits & Edit Defaults and give both ANONYMOUS LOGON and Everyone all given full permissions. E.g. [Local Access, Remote Access]
Launch and Activation Permissions => Edit Limits & Edit Defaults and give both ANONYMOUS LOGON and Everyone all given full permissions. E.g. [Local Launch, Remote Launch, Local Activation, Remote Activation]
Go to Start => Run=>DComcnfg => Component Services => My Computer => DCOM Config =>Hosting Controller =>Properties => Security =>
Launch and Activation Permissions =>Customize=> Edit and give full permissions to both ANONYMOUS LOGON and Everyone.
Access Permissions =>Customize=> Edit and full permissions to both ANONYMOUS LOGON and Everyone.
Configuration Permissions=>Customize=> Edit and full permissions to both ANONYMOUS LOGON and Everyone.
Open your services control manager as follows:
Start=>Run=>Services.msc and stop and disable the Windows Firewall/Internet Connection Sharing (ICS) service.
RPC and HC Services should be running on both machines. For further detailed information read this article. https://www.hostingcontroller.com/english/support/kb/HCKB-Article101.html
“Enable Distributed COM” & “Enable COM Internet Services on this Computer” on both HC Primary and Remote machines. Both of them can be enabled as follows:
Start=>Run=>Dcomcnfg=>Component Services=>My Computer=>Propertiese=>Default Properties Tab.
DCOM should be properly configured on all machines. For further details about configuring DCOM please read. https://www.hostingcontroller.com/english/support/kb/HCKB-Article42.html
The HC Secondary Installer should be with latest hot fix on remote machines. https://hostingcontroller.com/english/downloads/hcsec.exe (HCv6.1 Windows Secondary Installer)
https://hostingcontroller.com/english/sp/index.html (Latest Hot fix)
Register HCDcomClient.dll by giving the following command on both machines.
*X\dll\regsvr32 HCDComClient.dll
In case of firewalls open related ports of firewall for proper. https://hostingcontroller.com/english/support/kb/HCKB-Article60.html
HC uses built-in DCom of Microsoft for remote communication which is comparatively a slow method of communication. In case your machines are in different physical locations, it is recommended to move all machines with in the same LAN to avoid any problem.
NOTE:

In coming version .Net Technology will be used instead of DCOM, which will minimize this threat.
If the problem persists even after following these steps, send the respective HC DCOM logs located at *X:\Logs on HC primary machine to HC support for further investigation.
support@hostingcontroller.com
“X” refers to the path where HC is installed. In most cases it might be as follows:
C:\Program Files\Advanced Communications\Hosting Controller

The post How do I fix DCOM Issue between Web Server and Remote Secondary Machines? appeared first on Hivelocity Hosting.

Click ‘Start’ > ‘Run’ >type ‘MMC’ press ok.

In the console click > ‘File’ > ‘Add/Remove Snap in’

In the ‘Standalone Tab’ click The ‘add’ button

Seclect ‘IP Security Policy Managment’ > ‘ADD’ > ‘Local Computer’ > ‘finish’ > ‘close’ > ‘ok’

You should now be back to the console.

In the left frame right click ‘IP security policies on local computer’ > ‘Create IP security policy’

Click Next and then name your policy ‘Block IP’ and type a description.

Click ‘Next’ then leave ‘activate’ ticked then click ‘Next’

leave the ‘edit properties ticked and click ‘Finish’

You should now have the properties window open.

Click ‘ADD’ then click ‘Next’ to continue.

Leave ‘This rule does not specify a tunnel’ selected and click ‘next’

Leave ‘all network connections’ selected and click ‘next’

You should now be on the IP filter list. You need to create a new filter, so dont select any of the default ones. Click ‘ADD’

Type a Name for your list, call it ‘IP block list’
Type a description in, can be same as name.
Click ‘ADD’ then click ‘Next’ to continue.

In the description box type a description. As its the first IP you are blocking call it ‘IP1’ or ‘IP Range 1’
Leave ticked the ‘Mirrored. Match packets with the exact opposite source and destination addresses’
Click ‘Next’

The ‘Source address’ should be left as ‘My IP address’ click ‘Next’

You can now select ‘A Specific IP address’ or ‘A Specific Subnet’ for the Destination address.
Type in the IP address you want to block and if blocking a subnet type in the subnet block. Click ‘next’

Leave the protocol type as ‘Any’ and click ‘Next’ and then ‘Finish’

You have now blocked your first IP or IP range.

The post Use Windows to block IP’s and IP ranges appeared first on Hivelocity Hosting.

To turn on the ICF (Internet Connection Firewall) feature in Windows Server 2003, follow these steps:

1. First, navigate to your Network Connections by clicking on the Start menu -> Settings -> Control Panel, and then double-clicking on Network Connections.
   
2. Right-click the connection that you want to enable the Firewall for and then click Properties on the shortcut menu that appears.
   
3. Click on the Advanced tab, and then click to select the “Protect my computer and network by limiting or preventing access to this computer from the Internet” check box.
   
4. Click on Settings. In the Services list, click to select the check boxes of services on the computer which you want to permit external access (if that is what you want).
   *Note: By default, no services are selected. This is known as a default deny stance. You must explicitly permit external access to the computer. For the most secure environment, do not select any of the check boxes.
   
5. Click OK twice.
   
6. When you’re finished, close the Network Connections window.

And there you have it!

Popular Links

Looking for more information on Firewalls? Search our Knowledge Base!

Interested in more articles about Security? Navigate to our Categories page using the bar on the left or check out these popular articles:

• How to Clear the YUM Cache
• How to Install Maldet and Run a Scan
• Reset the MySQL Root Password on Windows Server

Popular tags within this category include: YUM, Maldet, SSL, and more.

Don’t see what you’re looking for? Use the search bar at the top to search our entire Knowledge Base.

The Hivelocity Difference

Seeking a better Dedicated Server solution? In the market for Private Cloud or Colocation services? Check out Hivelocity’s extensive list of products for great deals and offers.

With best-in-class customer service, affordable pricing, a wide-range of fully-customizable options, and a network like no other, Hivelocity is the hosting solution you’ve been waiting for.

Unsure which of our services is best for your particular needs? Call or live chat with one of our sales agents today and see the difference Hivelocity can make for you.

The post How to Enable the Firewall in Windows Server 2003 appeared first on Hivelocity Hosting.