{"id":3719,"date":"2023-11-21T11:35:04","date_gmt":"2023-11-21T03:35:04","guid":{"rendered":"https:\/\/www.servergigabit.com\/guide\/?post_type=kb&p=3719"},"modified":"2026-01-09T15:27:11","modified_gmt":"2026-01-09T07:27:11","slug":"setting-up-a-firewall-configuration-on-linux-and-windows","status":"publish","type":"kb","link":"https:\/\/www.servergigabit.com\/guide\/kb\/setting-up-a-firewall-configuration-on-linux-and-windows","title":{"rendered":"Setting Up a Software Firewall on Linux and Windows"},"content":{"rendered":"
<\/header>\n
\n
\"Firewall<\/figure>\n
<\/div>\n

In an age where connectivity is omnipresent, safeguarding our digital boundaries has become paramount. Among the crucial defenses in this realm stands the Firewall configuration\u2014an indispensable guardian fortifying our systems against an array of potential threats.<\/p>\n

What is a Firewall?<\/strong><\/h2>\n

A Firewall<\/a> serves as a barrier between your computer\/network and the vast, potentially hazardous expanse of the internet. Much like a security checkpoint, it monitors incoming and outgoing traffic, permitting or blocking data packets based on predefined security rules. This vital piece of software discerns between safe and malicious activity, curbing unauthorized access and protecting sensitive data from cyber threats.<\/p>\n

The Role of Firewalls<\/strong><\/h2>\n

Firewalls come in various forms, from software-based solutions integrated into operating systems to dedicated hardware appliances. Regardless of the form, their role remains consistent: shielding devices and networks by filtering traffic, preventing unauthorized access, and minimizing the risk of cyber attacks.<\/p>\n

\n
\n
\n
\n
\n
\n
\n

Setting Up a Basic Firewall<\/strong><\/h2>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
\n

By default, SSH connections are typically established through Port 22 (TCP). The main advantage of using the default SSH-2 protocol (compared to VNC) is the encrypted connection using an AES algorithm with a 128-bit key length. Therefore, it is generally recommended to use SSH instead of VNC whenever possible.<\/p>\n

In Linux, you should consider using the built-in software package ‘iptables’, which comes with the initial installation on most distributions by default.<\/p>\n

There are two main advantages to using iptables:<\/p>\n

    \n
  1. \n

    The required software package is installed by default on most Linux distributions.<\/p>\n<\/li>\n

  2. \n

    It is compatible with any Linux<\/a> distribution (Ubuntu, Debian, CentOS, etc.) without restrictions.<\/p>\n<\/li>\n<\/ol>\n

    You can also define IPv4 and IPv6 rules according to your own needs.<\/p>\n

    Checking the Current Firewall Configuration<\/strong><\/h4>\n

    Before configuring your firewall, there are no rules defined. To check this, use the following command:<\/p>\n

    \n
    iptables -L<\/code><\/pre>\n<\/div>\n
    The output will look similar to this:<\/p>\n
    \"IP<\/p>\n
    As you can see, there are currently no rules defined. The Software-Firewall will not block anything.<\/p>\n
    Adding Firewall Rules<\/strong><\/h4>\n
    To add firewall rules, use the following syntax:<\/p>\n
    \n
    iptables <ADD: -A> | <Chain: INPUT \/ Output> | <Source\/Destination: -d \/ -s> | <action: -j> | <Art: ACCEPT><\/code><\/pre>\n<\/div>\n
    Here’s an example of how to use the iptables command to allow incoming traffic at port 80:<\/p>\n
    \n
    iptables -A INPUT -p tcp --dport 80 -j ACCEPT<\/code><\/pre>\n<\/div>\n
    Example Firewall Configuration for Linux<\/strong><\/h4>\n
    Here is an example script that will open the most commonly used ports on your Linux server:<\/p>\n
    \n
    #!\/bin\/bash<\/span>\r\n\r\n# Delete the current firewall setup:<\/span>\r\niptables -F\r\n\r\n# Define default rules for all chains:<\/span>\r\niptables -P INPUT DROP\r\niptables -P FORWARD DROP\r\n\r\n# Allow incoming\/outgoing localhost frames for tests (e.g.\u00a0Webserver, Mailserver):<\/span>\r\niptables -A INPUT -d 127.0.0.1 -j ACCEPT\r\niptables -A OUTPUT -s 127.0.0.1 -j ACCEPT\r\n\r\n# Allow loopback frames for the internal process management:<\/span>\r\niptables -A INPUT -i lo -j ACCEPT\r\n\r\n# Allow incoming\/outgoing related-established connections:<\/span><\/span>\r\niptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\r\niptables -A OUTPUT -m state --state RELATED,ESTABLISHED<\/span> -j ACCEPT\r\n\r\n# Allow incoming PING-Requests:<\/span>\r\niptables -A INPUT -p icmp -j ACCEPT\r\n\r\n# Allow incoming SSH connections:<\/span>\r\niptables -A INPUT -p tcp --dport 22 -j ACCEPT\r\n\r\n# Allow incoming HTTP\/HTTPS requests:<\/span>\r\niptables -A INPUT -p tcp --dport 80 -j ACCEPT\r\niptables -A INPUT -p tcp --dport 443 -j ACCEPT\r\n\r\n# Allow incoming DNS requests:<\/span>\r\niptables -A INPUT -p udp --dport 53 -j ACCEPT\r\niptables -A INPUT -p tcp --dport 53 -j ACCEPT<\/code><\/pre>\n<\/div>\n
    To use this script:<\/strong><\/h4>\n
      \n
    1. \n
      Login to your Linux server as root.<\/p>\n<\/li>\n
    2. \n
      Create a shellscript with this command:<\/p>\n<\/li>\n<\/ol>\n
      \n
      nano firewall.sh<\/code><\/pre>\n<\/div>\n
        \n
      1. \n
        Paste in the content shown above.<\/p>\n<\/li>\n
      2. \n
        Save the file with [CTRL] + O and exit the editor with [CTRL] + X.<\/p>\n<\/li>\n
      3. \n
        Make the script executable with this command:<\/p>\n<\/li>\n<\/ol>\n
        \n
        chmod +x firewall.sh<\/code><\/pre>\n<\/div>\n
          \n
        1. To run the script and open the ports provided by the script, use the following command:<\/li>\n<\/ol>\n
          \n
          .\/firewall.sh<\/code><\/pre>\n<\/div>\n
          Making the Firewall Rules Permanent<\/strong><\/h2>\n
          Please note that if you use the sample script, all firewall rules will not be added permanently. After a server reboot, every rule would have to be set manually again.<\/p>\n
          To make the firewall rules permanent, you can run the following commands depending on your operating system:<\/p>\n
          Permanent Firewall Settings for CentOS 7 or higher:<\/strong><\/h4>\n
          \n
          yum install -y iptables-services\r\nsystemctl stop firewalld\r\nsystemctl mask firewalld\r\nsystemctl <\/span>enable<\/span><\/span> iptables.service\r\nsystemctl<\/span> -t service | grep iptables\r\n\/usr\/libexec\/iptables\/iptables.init save<\/code><\/pre>\n<\/div>\n
          Permanent Firewall Settings for Debian\/Ubuntu:<\/strong><\/h4>\n
          \n
          apt-get install iptables-persistent netfilter-persistent\r\n\"How\r\n<\/code><\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
          \n
          Saving the Current Firewall Configuration<\/strong><\/h4>\n
          You can also save your currently configured firewall rules if you have not saved them to the above files with this command:<\/p>\n
          \n
          iptables-save > \/etc\/iptables\/rules.v4 && ip6tables-save > \/etc\/iptables\/rules.v6\r\n\"How<\/code><\/pre>\n<\/div>\n
          Restoring a Backup of the Firewall Configuration<\/strong><\/h4>\n
          We strongly recommend creating a backup of the current firewall setup to be able to immediately restore the previous configuration (e.g., connection locks).<\/p>\n
          To save your current IPv4\/IPv6 firewall setup into a backup file, use the following commands:<\/p>\n
          \n
          iptables-save > \/root\/iptables_rules\r\nip6tables-save > \/root\/ip6tables_rules<\/code><\/pre>\n<\/div>\n
          To restore the backup files, use:<\/p>\n
          \n
          iptables-restore < \/root\/iptables_rules\r\niptables-restore < \/root\/ip6tables_rules<\/code><\/pre>\n<\/div>\n
          Restoring Access to a Server with a Misconfigured Firewall<\/strong><\/h4>\n
          If you need to reconnect to your server due to a misconfigured firewall setup, you could use your VNC connection for your VPS to restore a previous configuration.<\/p>\n
          \"How<\/p>\n
          If you have a Dedicated Server, VNC access is not possible. You will have to reboot your server into the Linux rescue system to regain access.<\/p>\n
          Setting up a Basic Firewall for Windows<\/strong><\/h2>\n
          The Windows Firewall can be found within the Server-Manager settings as follows:<\/p>\n
          \n
          Windows-Firewall -> Public: On-> Advanced settings<\/code><\/pre>\n<\/div>\n
          \"How<\/p>\n
          \"How<\/p>\n
          \"How<\/p>\n
          \"How
          \nYou can now modify your firewall rules according to your own needs.<\/p>\n
          The main difference between Linux and Windows is that Windows provides a basic firewall configuration by default. In most cases, it should be enough to keep the default setup or modify existing rules.<\/p>\n
          All active firewall rules are marked with a green tag. The rest of the rules (without any tag) need to be activated if required. Feel free to customize the firewall setup according to your own needs.<\/p>\n
          \"How\"How\"How<\/p>\n
          For example, if you would like to change your RDP port to a different one instead of the default “3389,” you will have to modify the following two firewall rules within the “Inbound rule” chain:<\/p>\n
          \n
          Remote Desktop - User Mode (TCP-In)\r\nRemote Desktop -\u00a0User Mode (UDP-In)\r\n<\/code><\/pre>\n<\/div>\n
          You will then need to modify the affected Windows registry entry to the new value. However, to prevent disasters, make sure to create a full backup of the registry beforehand:<\/p>\n
            \n
          1. \n
            Press the WINDOWS button + R (keyboard command).<\/p>\n<\/li>\n
          2. \n
            Type “regedit” and press Enter.<\/p>\n<\/li>\n
          3. \n
            Click “File” > “Export.”<\/p>\n<\/li>\n
          4. \n
            Enter a name for the backup file and click “Save.<\/span>“<\/span><\/p>\n<\/li>\n
          5. \n
            Now you can navigate to the following path to set the new RDP port number:
            \n\"Windows
            \n<\/span><\/p>\n<\/li>\n<\/ol>\n
            \n
            HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\PortNumber\r\n<\/code><\/pre>\n<\/div>\n
              \n
            1. \n
              Double-click the “PortNumber” registry entry.<\/span><\/p>\n<\/li>\n
            2. \n
              In the “Value data” field,<\/span> enter the new port number.<\/span><\/p>\n<\/li>\n
            3. \n
              Click “OK.<\/span>“<\/span><\/p>\n<\/li>\n
            4. \n
              Restart your Windows server.<\/span><\/p>\n<\/li>\n<\/ol>\n
              Now your new RDP port should be active.<\/span><\/p>\n
              Conclusion<\/strong><\/h2>\n
              Setting up a software firewall is an essential security measure for both Linux and Windows systems. The process is relatively straightforward and can be accomplished using built-in tools on both platforms. By following the instructions in this guide, you can effectively protect your server from unauthorized access and malicious attacks.<\/p>\n<\/figure>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
              In an age where connectivity is omnipresent, safeguarding our digital boundaries has become paramount. Among the crucial defenses in this realm stands the Firewall configuration\u2014an indispensable guardian fortifying our systems against an array of potential threats. What is a Firewall? A Firewall serves as a barrier between your computer\/network and the vast, potentially hazardous expanse of the internet. Much like…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"kbtopic":[1099],"kbtag":[1189],"class_list":["post-3719","kb","type-kb","status-publish","hentry","kbtopic-tutorials","kbtag-firewall"],"_links":{"self":[{"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kb\/3719","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kb"}],"about":[{"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/types\/kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/comments?post=3719"}],"version-history":[{"count":9,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kb\/3719\/revisions"}],"predecessor-version":[{"id":5621,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kb\/3719\/revisions\/5621"}],"wp:attachment":[{"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/media?parent=3719"}],"wp:term":[{"taxonomy":"kbtopic","embeddable":true,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kbtopic?post=3719"},{"taxonomy":"kbtag","embeddable":true,"href":"https:\/\/www.servergigabit.com\/guide\/wp-json\/wp\/v2\/kbtag?post=3719"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}