Network Security Deep Dive: Firewall Rules and Network Segmentation

The Foundation of Network Security

Network security starts with a simple principle: only allow traffic that is explicitly needed, and deny everything else. In a cloud hosting environment, this means configuring firewalls at multiple layers -- host-level, network-level, and provider-level -- and segmenting your infrastructure so that a compromise in one area cannot spread to others.

Whether you are running a single VPS or managing a fleet of dedicated servers across multiple datacenters, the same principles apply.

Understanding iptables Architecture

iptables is the traditional Linux firewall that works with netfilter, the kernel's packet filtering framework. It organizes rules into chains and tables:

• **Filter table** (default): INPUT, OUTPUT, FORWARD chains
• **NAT table**: PREROUTING, POSTROUTING chains for address translation
• **Mangle table**: For packet modification

A solid baseline iptables configuration:

#!/bin/bash
# Flush existing rules
iptables -F
iptables -X
iptables -t nat -F

# Default policies: drop everything iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT

# Allow loopback iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT

# Allow established and related connections iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH (custom port) with brute-force protection iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --set --name SSH iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -j ACCEPT

# Allow HTTP and HTTPS iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow ICMP (ping) with rate limiting iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 4 -j ACCEPT

# Log dropped packets iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4 ```

Save these rules to persist across reboots:

sudo apt install iptables-persistent
sudo netfilter-persistent save

Migrating to nftables

nftables is the modern replacement for iptables with a cleaner syntax and better performance:

#!/usr/sbin/nft -f
flush ruleset

table inet firewall { chain input { type filter hook input priority 0; policy drop; iif "lo" accept ct state established,related accept tcp dport 2222 ct state new limit rate 4/minute accept tcp dport {80, 443} accept ip protocol icmp limit rate 1/second accept limit rate 5/minute log prefix "nftables-dropped: " drop } chain forward { type filter hook forward priority 0; policy drop; } chain output { type filter hook output priority 0; policy accept; } } ```

sudo systemctl enable nftables
sudo systemctl start nftables

Implementing Network Segmentation with VLANs

Network segmentation divides your infrastructure into isolated zones, limiting lateral movement. In a typical three-tier architecture:

• **DMZ zone** (VLAN 10): Public-facing web servers
• **Application zone** (VLAN 20): Backend application servers
• **Database zone** (VLAN 30): Database servers with no direct internet access
• **Management zone** (VLAN 40): SSH bastion, monitoring, logging servers

Configure VLANs on a Linux server acting as a router:

# Create VLAN interfaces
sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip link add link eth0 name eth0.20 type vlan id 20
sudo ip link add link eth0 name eth0.30 type vlan id 30

# Assign IP addresses sudo ip addr add 10.10.10.1/24 dev eth0.10 sudo ip addr add 10.10.20.1/24 dev eth0.20 sudo ip addr add 10.10.30.1/24 dev eth0.30

# Bring interfaces up sudo ip link set eth0.10 up sudo ip link set eth0.20 up sudo ip link set eth0.30 up ```

Create inter-VLAN firewall rules that enforce the principle of least privilege:

# Allow web servers (VLAN 10) to talk to app servers (VLAN 20) on port 8080
iptables -A FORWARD -i eth0.10 -o eth0.20 -p tcp --dport 8080 -j ACCEPT
iptables -A FORWARD -i eth0.20 -o eth0.10 -p tcp --sport 8080 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow app servers (VLAN 20) to talk to databases (VLAN 30) on port 5432 iptables -A FORWARD -i eth0.20 -o eth0.30 -p tcp --dport 5432 -j ACCEPT

# Deny direct web-to-database traffic iptables -A FORWARD -i eth0.10 -o eth0.30 -j DROP ```

Security Groups in the Cloud

If you run on ServerRaja's cloud platform or any OpenStack-based cloud, leverage security groups:

openstack security group create web-sg
openstack security group create app-sg
openstack security group create db-sg

openstack security group rule create --protocol tcp --dst-port 80 web-sg openstack security group rule create --protocol tcp --dst-port 443 web-sg openstack security group rule create --protocol tcp --dst-port 8080 --remote-group web-sg app-sg openstack security group rule create --protocol tcp --dst-port 5432 --remote-group app-sg db-sg ```

Logging and Testing

Configure rsyslog to write firewall logs to a dedicated file and rotate them:

# /etc/rsyslog.d/iptables.conf
:msg, contains, "IPTables-Dropped" /var/log/iptables.log
& stop

Test your firewall with `nmap` from an external host:

nmap -sT -p 22,80,443,3306,5432,6379 your-server-ip
nmap -sS -p 1-65535 your-server-ip

Internal scanning from each VLAN verifies segmentation:

# From web tier, verify database ports are unreachable
nmap -Pn -p 5432 10.10.30.100

Conclusion

Effective network security requires defense in depth: host-level firewalls, network segmentation, cloud security groups, and continuous monitoring. Start with a default-deny policy, open only what is needed, segment your tiers, and log everything. At ServerRaja, our cloud platform provides security groups and private networking out of the box, but the additional host-level hardening covered in this guide is essential.