9. Firewall

What do I need that for?

A firewall is very essential and should be part of every server. It prevents hackers from accessing applications running on your servers they should not have access to. This includes Minecraft servers. Without special security measurements, the popular "BungeeCord offline mode bug" can be exploited, enabling hackers to control your Minecraft network. People are using various solutions to fix this security breach - including simple plugins. It would be possible to include such a feature in TimoCloud as well. However, we believe that a firewall should be used on every server because a Minecraft server is not the only potential vulnerability, so we do not want to promote not having one by providing a different fix.

How to setup a firewall

One popular solution is iptables. It is included by default in many linux distributions, but you can install it using sudo apt install iptables. Using simple bash commands, you can make iptables block any incoming or outgoing connections. Hence, we will write a little script that has to be run after every linux server restart. Later, I will explain how run the script automatically when your server starts up.

Here is a simple iptables configuration script. MAKE SURE TO OPEN YOUR SSH PORT as shown below! OTHERWISE, YOU WILL NOT BE ABLE TO ACCESS YOUR SERVER ANYMORE.

#!/bin/sh
# A very basic IPtables / Netfilter script

PATH='/sbin'

# Flush the tables to apply changes
iptables -F

# Default policy to drop 'everything' but our output to internet
iptables -P FORWARD ACCEPT
iptables -P INPUT   DROP
iptables -P OUTPUT  ACCEPT

# Allow established connections (the responses to our outgoing traffic)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow local programs that use loopback (Unix sockets)
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT

iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Allow incoming connections to specific ports
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT # SSH!!!
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT # Webserver
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT # Webserver
iptables -A INPUT -p tcp --dport 25565 -m state --state NEW -j ACCEPT # Minecraft

Create the directory /etc/firewall/ by running mkdir /etc/firewall/

Next, create the file /etc/firewall/firewall.sh and paste the content shown above. Copy the last line for every port that needs to be accessible.

To open a range of ports (e.g. 30000-31000), use this line: iptables -A INPUT -p tcp --match multiport --dports 30000:31000 -j ACCEPT

Congratulations, we are nearly finished! Make the script runnable: sudo chmod +x /etc/firewall/firewall.sh and execute it: sudo /etc/firewall/firewall.sh

Now, open a second SSH terminal and make sure you are still able to connect to your server. Otherwise, use the open terminal to run sudo iptables -F in order to reset your iptables configuration and then try to connect again.

If everything works, you are finished! In order to open additional ports, simply edit the script and execute it again (/etc/firewall/firewall.sh).

Automatically executing the script on startup

You can tell linux to automatically run your script on every server startup (which is necessary for the firewall in order to work). To do so, create the file /etc/systemd/system/firewall.service and paste the following content:

[Unit]
Description=Firewall

Before=network-pre.target
Wants=network-pre.target
After=local-fs.target

DefaultDependencies=no

[Service]
ExecStart=/etc/firewall/firewall.sh

Type=oneshot
RemainAfterExit=yes

[Install]
WantedBy=basic.target

Make linux register the script by executing the command sudo systemctl daemon-reload.

Finally, type sudo systemctl enable firewall to make linux run your script on startup. If no error is returned, everything should be fine.