Debian : Firewall (IPTables) - Revision history

Novy: Changed protection settings for "Debian : Firewall (IPTables)" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite)) [cascading]

2025-10-31T13:17:29Z

Changed protection settings for "Debian : Firewall (IPTables)" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite)) [cascading]

← Older revision	Revision as of 20:17, 31 October 2025
(No difference)

192.168.100.1: /* Apa itu IPTables? */

2025-10-31T13:17:13Z

Apa itu IPTables?

← Older revision		Revision as of 20:17, 31 October 2025
Line 1:		Line 1:
	== Apa itu IPTables? ==		== Apa itu IPTables? ==
	'''iptables''' adalah firewall berbasis ''packet filtering'' yang bekerja menggunakan '''Netfilter''' di kernel Linux.		'''iptables''' adalah firewall berbasis ''packet filtering'' yang bekerja menggunakan '''Netfilter''' di kernel Linux

	Ia mengatur lalu-lintas '''IPv4''' (ada juga <code>ip6tables</code> untuk IPv6).		Ia mengatur lalu-lintas '''IPv4''' (ada juga <code>ip6tables</code> untuk IPv6).

Novy: /* Save dan Restore IPTables */

2025-10-31T13:13:32Z

Save dan Restore IPTables

← Older revision		Revision as of 20:13, 31 October 2025
Line 121:		Line 121:
	sudo netfilter-persistent save		sudo netfilter-persistent save
	</syntaxhighlight>Maka setiap server restart rule IPTables akan direstore otomatis		</syntaxhighlight>Maka setiap server restart rule IPTables akan direstore otomatis

			== Perintah lengkap IPTables untuk penggunaan standar server ==
			<syntaxhighlight lang="shell" line="1">
			#!/bin/bash

			### ===============================
			### 1. RESET FIREWALL
			### ===============================

			# Hapus semua rules di semua chain
			iptables -F

			# Hapus semua custom chain
			iptables -X

			# Hapus rules NAT
			iptables -t nat -F
			iptables -t nat -X

			# Hapus rules mangle
			iptables -t mangle -F
			iptables -t mangle -X


			### ===============================
			### 2. SET DEFAULT POLICY
			### ===============================

			# Semua input diblokir kecuali yang diizinkan
			iptables -P INPUT DROP
			# Tidak ada paket yang lewat forward tanpa izin
			iptables -P FORWARD DROP
			# Output diizinkan agar server bisa update / akses internet
			iptables -P OUTPUT ACCEPT


			### ===============================
			### 3. IZINKAN LOOPBACK (LOCALHOST)
			### ===============================

			# Izinkan komunikasi internal 127.0.0.1
			iptables -A INPUT -i lo -j ACCEPT


			### ===============================
			### 4. IZINKAN KONEKSI YANG SUDAH TERBENTUK
			### ===============================

			# Balasan dari koneksi yang sudah berjalan (stateful firewall)
			iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
			iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


			### ===============================
			### 5. LAYANAN SERVER (SEMUA LAYANAN)
			### ===============================

			### SSH ###
			iptables -A INPUT -p tcp --dport 22 -j ACCEPT

			### HTTP / HTTPS ###
			iptables -A INPUT -p tcp --dport 80 -j ACCEPT
			iptables -A INPUT -p tcp --dport 443 -j ACCEPT

			### FTP ###
			iptables -A INPUT -p tcp --dport 21 -j ACCEPT

			### DNS (UDP & TCP) ###
			iptables -A INPUT -p udp --dport 53 -j ACCEPT
			iptables -A INPUT -p tcp --dport 53 -j ACCEPT

			### DHCP Server (port 67 dan 68) ###
			iptables -A INPUT -p udp --dport 67:68 -j ACCEPT

			### SMTP (Mail server) ###
			iptables -A INPUT -p tcp --dport 25 -j ACCEPT
			iptables -A INPUT -p tcp --dport 587 -j ACCEPT

			### POP3 / IMAP ###
			iptables -A INPUT -p tcp --dport 110 -j ACCEPT
			iptables -A INPUT -p tcp --dport 143 -j ACCEPT

			### Secure POP3 / IMAP ###
			iptables -A INPUT -p tcp --dport 465 -j ACCEPT
			iptables -A INPUT -p tcp --dport 993 -j ACCEPT
			iptables -A INPUT -p tcp --dport 995 -j ACCEPT

			### MySQL ###
			iptables -A INPUT -p tcp --dport 3306 -j ACCEPT

			### PostgreSQL ###
			iptables -A INPUT -p tcp --dport 5432 -j ACCEPT

			### VPN ###
			iptables -A INPUT -p udp --dport 1194 -j ACCEPT # OpenVPN
			iptables -A INPUT -p udp --dport 51820 -j ACCEPT # Wireguard

			### Proxy ###
			iptables -A INPUT -p tcp --dport 3128 -j ACCEPT # Squid


			### ===============================
			### 6. ROUTER / NAT (IP MASQUERADE)
			### ===============================

			# (GANTI eth0 dengan interface internet)
			WAN="eth0"
			LAN="eth1"

			# NAT agar client LAN bisa akses internet
			iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE

			# Izinkan trafik dari LAN ke internet
			iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT

			# Izinkan trafik dari internet ke LAN jika ada port forwarding
			iptables -A FORWARD -i $WAN -o $LAN -m state --state RELATED,ESTABLISHED -j ACCEPT


			### ===============================
			### 7. PROTEKSI DASAR (ANTI BRUTE-FORCE SSH)
			### ===============================

			# Jika 4 kali gagal SSH dalam 1 menit → DROP
			iptables -A INPUT -p tcp --dport 22 -m recent --set
			iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 -j DROP


			### ===============================
			### 8. LOGGING (OPSIONAL)
			### ===============================

			# Log paket yang di-drop (agar mudah troubleshoot)
			iptables -A INPUT -j LOG --log-prefix "IPTABLES-DROP: " --log-level 4

			echo "Firewall berhasil diterapkan!"
			</syntaxhighlight>

Novy: /* Konsep penting: Connection Tracking */

2025-10-31T13:08:35Z

Konsep penting: Connection Tracking

← Older revision		Revision as of 20:08, 31 October 2025
Line 68:		Line 68:
	-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT		-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	</syntaxhighlight>→ Supaya koneksi yang sudah terbentuk tidak diblokir.		</syntaxhighlight>→ Supaya koneksi yang sudah terbentuk tidak diblokir.

			== Sintaks dasar perintah IPTables ==
			Format:<syntaxhighlight lang="shell">
			iptables [tabel] [aksi] [parameter] -j [target]
			</syntaxhighlight>Contoh : <syntaxhighlight lang="shell">
			iptables -A INPUT -p tcp --dport 22 -j ACCEPT
			</syntaxhighlight>Keterangan:

			* <code>-A</code> = append (tambahkan rule)
			* <code>INPUT</code> = chain
			* <code>-p tcp</code> = protokol
			* <code>--dport 22</code> = port 22
			* <code>-j ACCEPT</code> = tindakan

			Aksi lain:

			* <code>-I</code> = insert di awal
			* <code>-D</code> = delete
			* <code>-F</code> = flush (hapus semua rule)
			* <code>-L</code> = list rules

			== Konfigurasi Firewall Dasar ==

			=== Contoh 1 - Izinkan SSH (port 22) ===
			<syntaxhighlight lang="shell">
			iptables -A INPUT -p tcp --dport 22 -j ACCEPT
			</syntaxhighlight>

			=== Contoh 2 - Izinkan trafik yang sudah established ===
			<syntaxhighlight lang="shell">
			iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
			</syntaxhighlight>

			=== Contoh 3 - Izinkan loopback ===
			<syntaxhighlight lang="shell">
			iptables -A INPUT -i lo -j ACCEPT
			</syntaxhighlight>

			=== Contoh 4 - Drop semua input selain yang diizinkan ===
			<syntaxhighlight lang="shell" line="1">
			iptables -P INPUT DROP
			iptables -P FORWARD DROP
			iptables -P OUTPUT ACCEPT
			</syntaxhighlight>

			== Save dan Restore IPTables ==
			Debian tidak menyimpan rules secara otomatis.

			Gunakan paket:<syntaxhighlight lang="shell">
			sudo apt install iptables-persistent
			</syntaxhighlight>Lalu simpan:<syntaxhighlight lang="shell">
			sudo netfilter-persistent save
			</syntaxhighlight>Maka setiap server restart rule IPTables akan direstore otomatis

Novy: /* Rules */

2025-10-31T12:56:00Z

Rules

← Older revision		Revision as of 19:56, 31 October 2025
Line 54:		Line 54:
	* protokol		* protokol
	* action (ACCEPT, DROP, REJECT)		* action (ACCEPT, DROP, REJECT)

			=== <u>Konsep penting: Connection Tracking</u> ===
			iptables bersifat '''stateful''', artinya firewall tahu keadaan koneksi.

			State umum:

			* <code>NEW</code> — koneksi baru
			* <code>ESTABLISHED</code> — koneksi yang sudah berjalan
			* <code>RELATED</code> — koneksi tambahan (FTP, ICMP error)
			* <code>INVALID</code> — paket rusak/tidak sesuai

			Contoh rule penting:<syntaxhighlight lang="shell">
			-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
			</syntaxhighlight>→ Supaya koneksi yang sudah terbentuk tidak diblokir.

Novy at 12:53, 31 October 2025

2025-10-31T12:53:36Z

@@ Line 12: / Line 12: @@
 == Arsitektur Dasar (Tables, Chains, Rules) ==
-=== '''Tabel (Tables)''' ===
+=== <u>Tabel (Tables)</u> ===
-sasa
+Tabel adalah kategori besar untuk aturan firewall.

Novy: /* Apa itu IPTables? */

2025-10-31T12:50:39Z

Apa itu IPTables?

← Older revision		Revision as of 19:50, 31 October 2025
Line 1:		Line 1:
	== Apa itu IPTables? ==		== Apa itu IPTables? ==
			'''iptables''' adalah firewall berbasis ''packet filtering'' yang bekerja menggunakan '''Netfilter''' di kernel Linux.

			Ia mengatur lalu-lintas '''IPv4''' (ada juga <code>ip6tables</code> untuk IPv6).

			Walaupun Debian 12 memakai '''nftables secara default''', '''iptables masih sangat penting untuk dipahami''', karena:

			* Banyak server lama masih memakai iptables.
			* Banyak software firewall (fail2ban, docker versi lama, kube-proxy lama) masih berinteraksi dengan iptables.
			* Banyak job IT meminta kemampuan iptables.

			== Arsitektur Dasar (Tables, Chains, Rules) ==

			=== '''Tabel (Tables)''' ===
			sasa

Novy: Protected "Debian : Firewall (IPTables)" ([Move=Allow only administrators] (indefinite))

2025-10-31T12:49:05Z

Protected "Debian : Firewall (IPTables)" ([Move=Allow only administrators] (indefinite))

← Older revision	Revision as of 19:49, 31 October 2025
(No difference)

Novy: Created page with "== Apa itu IPTables? =="

2025-10-31T12:48:58Z

Created page with "== Apa itu IPTables? =="

New page

== Apa itu IPTables? ==