Ttyjfyk

I am trying to use iptables but I am clueless in understanding the documentation even so that I've locked myself out of my server twice already whilst trying to implement it.

These are the simple rules that I want to implement:

• Allow ports 80, 6667 and 6697 to everyone


• Allow port 22 to just my IP for example 10.10.10.10
  

Please can someone help me implement these simple rules, without locking myself out?

I would advice against playing with iptables directly if you're not ready to learn the basics of networking, TCP(ICMP/UDP/SCTP...)/IP, Linux's netfilter and how to do proper firewalling first.

Here, since you're on Debian, I would install something like ufw, a very simple management layer on top of iptables.

It sets a default policy of ACCEPT for outgoing traffic, and DROP for incoming or forwarding traffic. It will take care of not shooting in your feet by not blocking needing types of ICMP/DHCP/broadcast/multicast traffic and handle both IPv4 and IPv6 as needed.

Then all is left for you to do is punch holes for the services that you want. Some packages will also install files in /etc/ufw/applications.d/ to help you punch hole by application instead of having to specify the ports by hand (you can also create your own).

ufw app list

gives you a list of those supported applications. Then you can do:

ufw allow from 10.10.10.10 app OpenSSH
ufw allow from any app WWW
ufw allow ircd/tcp # by service name (from /etc/services...)
ufw allow 6697/tcp # by explicit port number
ufw enable

You can run iptables-save to see what rules it has generated. It will also have tune some settings of the IP stack. See also the extra configuration in /etc/ufw.

Use the filter table in iptables and add the rule you want
first flush all rules in filter table in iptables:

sudo iptables -t filter -F

then add rule to allow ESTABLISHED,RELATED connection:

sudo iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

then for allowing ports 80, 6667 and 6697 for tcp to everyone add:

sudo iptables -t filter -A INPUT -p tcp -m multiport --dports 80,6667,6697 -j ACCEPT

and for allowing port 22 for just your ip add:

sudo iptables -t filter -A INPUT -s <your ip address> -p tcp --dport 22 -J ACCEPT

then to block anything else add:

sudo iptables -t filter -A INPUT -j DROP

Done.

If you're interested in learning how to use iptables, I would recommend not trying to configure it on a server, but instead to install iptables on a local machine (e.g., a VM or your laptop) and experimenting with it there. That way, if you make a mistake, you're not going to lock yourself out of your system.

Personally, even after fifteen years of administering Linux servers and manually writing iptables scripts, I never ever update firewall configuration unless I have a way to immediately reboot the server in case I make a mistake (be it through a KVM system, a hoster's control panel, or by being able to physically walk to the machine). After all, mistakes are always possible, and you don't want to accidentally lock yourself out of your own server for seven hours because of a simple typo.