Linux Iptables Setup Firewall For a Web Server

cyberciti.biz/faq/linux-web-server-firewall-tutorial

January 15, 2013

I have setup an Apache web server on CentOS Linux. How do I

configure firewall to allow or block access? How do I setup firewall
for a web server under RHEL or CentOS Linux v6.x or 7.x?

The default iptables configuration on a CentOS or RHEL does not

allow access to the HTTP (TCP PORT # 80) and HTTPS (TCP
PORT # 443) ports used by the Apache (or Nginx) web server. You
need to open those ports using iptables based firewall on a
RHEL/CentOS Linux 6.x.
You can modify settings using any one of the following three methods that works on
RHEL/CentOS 6.x:

1. /etc/sysconfig/iptables : Edit this file to allow or deny access to the Apache

Web Server IPv4. You also need to edit the /etc/sysconfig/ip6tables file to allow
or deny access to the Apache Web Server IPv6 ports.
2. system-config-firewall-tui command (runs on ssh text based session) or
system-config-firewall command (run on GUI based session) : This is a
graphical user interface for setting basic firewall rules. This tool will always overwrite
/etc/sysconfig/iptables file.
3. /sbin/iptables command : Use iptables command directly to modify/append/add
firewall rules. The rules can be saved to /etc/sysconfig/iptables file with
/sbin/service iptables save command.
4. /usr/sbin/lokkit command : This is a basic firewall configuration tool, designed
for ease of use and configuration. This tool also supports SELinux config option. This
tool is considered as deprecated and not covered in this faq.

If you are using a RHEL/CentoS version 7.x, see the note at the end of this page on
firewall-cmd.

Method 1. Edit /etc/sysconfig/iptables file (recommend for

advanced users)
Edit the IPv4 /etc/sysconfig/iptables, enter:
# vi /etc/sysconfig/iptables
Add the following lines, ensuring that they appear before the final LOG and DROP lines for
INPUT chain:

1/7
 ## allow everyone to access port 80 and 443 (IPv4
Only)##

-A INPUT -m state --state NEW -p tcp --dport 80 -j

ACCEPT
-A INPUT -m state --state NEW -p tcp --dport 443 -j
ACCEPT

Save and close the file. Restart the IPv4 iptables service:
# service iptables start
Edit the IPv6 /etc/sysconfig/ip6tables, enter:
# vi /etc/sysconfig/ip6tables
Add the following lines, ensuring that they appear before the final LOG and DROP lines for
INPUT chain:

## allow everyone to access port 80 and 443 (IPv6 Only)##

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j

ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j
ACCEPT

Save and close the file. Restart the IPv6 iptables service:
# service ip6tables restart

Method 2. Firewall configuration GUI/TUI tool (recommend for

new users)
The system-config-firewall command is a graphical user interface for setting basic firewall
rules. You need to have KDE or Gnome installed on the system. Open a terminal and type
the following command as root user:
# system-config-firewall
Sample outputs:

2/7
 Fig.01: GUI tool in action

Select services such as WWW, SSH, HTTPS to open port for everyone. Click on Apply
button. This tool will generate /etc/sysconfig/iptables as follows:

3/7
 Sample RHEL CentOS Linux /etc/sysconfig/iptables files

A note about text based config tool (recommend for remote server with ssh
access)
The sysystem-config-firewall-tui is a command line tool without having the GUI installed on
the server:
# system-config-firewall-tui
Sample outputs:

4/7
 Fig.02: system-config-firewall-tui in action

Select Enabled and Press Tab to select “Customization” :

Scroll down/up and select SSH, WWW, Secure WWW (HTTPS) and other required ports
you wish to open. Finally, select Close button. Finally, press OK button to activate new
firewall settings.

Method 3. /sbin/iptables command line utility (recommend for

advanced/expert users only)
Type the following iptables command as root user to open port 80 / 443:

## open port 80 and 443 for everyone ##

/sbin/iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j
ACCEPT
/sbin/iptables -A INPUT -m state --state NEW -p tcp --dport 443 -j
ACCEPT

## save newly added firewall rules ##

/sbin/service iptables save

## verify new firewall settings

/sbin/iptables -L -n -v
/sbin/iptables -L INPUT -n -v
/sbin/iptables -L INPUT -n -v | grep :80
/sbin/iptables -L INPUT -n -v | grep :443

The following rule allows access to port 80 and 443 only to 192.168.1.0/24

5/7
 ## Find an appropriate network block, and network mask
## representing the machines on your network which should operate as
## clients of the Apache Web-server

## Open port 80 and 443 for 192.168.1.0/24 subnet only ##

/sbin/iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 80 -j
ACCEPT
/sbin/iptables -A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 443 -j
ACCEPT

## save newly added firewall rules ##

/sbin/service iptables save

## verify new firewall settings

/sbin/iptables -L -n -v
/sbin/iptables -L INPUT -n -v
/sbin/iptables -L INPUT -n -v | grep :80
/sbin/iptables -L INPUT -n -v | grep :443

You can block/drop the IP address 202.54.1.1 or subnet 202.54.1.2/29 as follows using
iptables:

## Block access to port 80 ##

iptables -A INPUT -s 202.54.1.1 -p tcp --dport 80 -j DROP
iptables -A INPUT -s 202.54.1.2/29 -p tcp --dport 80 -j
DROP

## block and drop access to port 443 (secure apache web-

server)
iptables -A INPUT -s 202.54.1.1 -p tcp --dport 443 -j DROP
iptables -A INPUT -s 202.54.1.2/29 -p tcp --dport 443 -j
DROP

## save newly added firewall rules ##

/sbin/service iptables save

## verify new firewall settings

/sbin/iptables -L -n -v
/sbin/iptables -L INPUT -n -v | grep 202.54.1.1

Note: To unblock an IP i.e. delete the IP address 202.54.1.1 listed in iptables type the
following command:
iptables -D INPUT -s 202.54.1.1 -j DROP

A note about RHEL/CentOS 7.x users

You need to use the firewall-cmd command. firewall-cmd is the command line client of the
firewalld (a dynamically managed firewall with support for network/firewall zones) daemon.

firewalld open port 80

sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --reload

firewalld open port 443

sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload

6/7
Using a gui tool called firewall-config on a CentOS/RHEL 7.x
A graphical interface for basic firewalld setup can be installed as follows using the yum
command:
$ sudo yum install firewall-config
## must have GUI/X system installed on your server or do X forwarding over
SSH ##
$ sudo firewall-config

See also:
New Users Guide: CentOS / Redhat Iptables Firewall Configuration Tutorial
(CentOS/RHEL 6.x)
How to install and use Nginx on CentOS 7 / RHEL 7
More Examples For New Users: Linux: 25 Iptables Examples For New SysAdmins
Linux Configure Firewall Using Shorewall Under RHEL / CentOS

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a
trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on
SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email
newsletter.

7/7