# How To Secure Server Firewall Hardening | Make Your Server Strict!

**URL:** <https://onehack.st/t/how-to-secure-server-firewall-hardening-make-your-server-strict/211671>\
**Category:** Tutorials & Methods\
**Tags:** tools, tips-tricks\
**Created:** [January 9, 2022, 9:04am UTC](https://onehack.st/t/how-to-secure-server-firewall-hardening-make-your-server-strict/211671 "2022-01-09T09:04:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [January 9, 2022, 9:04am UTC](https://onehack.st/t/how-to-secure-server-firewall-hardening-make-your-server-strict/211671/1 "2022-01-09T09:04:48Z")

</div>

In order to secure your server, you will have to have a well configured firewall

Instead of blocking stuff you do not want, you should block everything and only allow stuff that you want - also called whitelisting

**Warning:** Be careful with your configurations, as you might lock yourself out of your server, if not done correctly.  
Do not run the commands one after one, instead run them inside a shell script, as otherwise you will be locked out, before you can finish your firewall configuration

First of all, block all traffic using iptables.

Code:

```auto
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

```

If you would leave your iptables configuration like that, your server would be secure, but you would not be able to access it yourself either - so we have to add exceptions  
We assume you have SSH running on port 37282

For your to be able to use ssh, you will have to add an iptables rule that allows traffic on the specific port

Code:

```auto
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 37282 -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp --sport 37282 -m state --state ESTABLISHED -j ACCEPT

```

To further harden the system you could only allow access to the port for one specified IP

A port knock would be another step, which only opens the port, when a specific set of ports has been connected to by a single IP in a specific order - this will cause a set port to open!

**Enjoy!**