Firewall & IDS/IPS

🔥 Vibe Prompt

"Set up iptables firewall rules. Configure Snort IDS for SQLi detection."

Iptables Firewall

# Default policies (drop all)
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (rate limited)
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow web traffic
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Log dropped packets
iptables -A INPUT -j LOG --log-prefix "iptables: " --log-level 4

# Save
iptables-save > /etc/iptables/rules.v4

Snort IDS Rules

# SQLi detection
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (
  msg: "SQL Injection - UNION";
  content: "UNION"; nocase;
  content: "SELECT"; nocase; within: 30;
  classtype: web-application-attack;
  sid: 1000001;
)

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (
  msg: "SQL Injection - OR true";
  content: "OR"; nocase;
  pcre: "/(\d+|')\s*OR\s*[\d=]+"/i;
  classtype: web-application-attack;
  sid: 1000002;
)

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (
  msg: "XSS Attempt";
  content: "<script>"; nocase;
  classtype: web-application-attack;
  sid: 1000003;
)

Fail2Ban

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

[nginx-botsearch]
enabled = true
filter = nginx-botsearch
logpath = /var/log/nginx/access.log
maxretry = 5
bantime = 86400

Defense Layers

Internet → WAF (Layer 7, app-level)
              ↓
          Firewall (Layer 3/4, IP/port)
              ↓
          IDS/IPS (Layer 7, signatures + anomaly)
              ↓
          HIDS (host-level, file integrity)

Best Practices

• Defense in depth: never rely on single layer
• Default deny all inbound
• Log all blocked traffic
• Regular rule review (eliminate stale rules)
• Automate with IaC (Ansible, Terraform)

Key Points

• Understand the core concepts thoroughly
• Practice with hands-on code examples
• Apply knowledge to real-world problems
• Review and reinforce through exercises

Further Learning

• Official documentation
• Open source projects on GitHub
• Community forums and discussions
• Related courses and tutorials