I have nginx serving files with uwsgi and I wanted to lock my server down just to allow SSH and Nginx to run. This is what I have:
i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default filter policy $i -P INPUT DROP $i -P OUTPUT DROP $i -P FORWARD DROP # Allow unlimited traffic on loopback $i -A INPUT -i lo -j ACCEPT $i -A OUTPUT -o lo -j ACCEPT # Open up ports for nginx $i -A INPUT -p tcp --dport 443 -j ACCEPT $i -A INPUT -p tcp --dport 80 -j ACCEPT $i -A INPUT -p tcp --dport 22 -j ACCEPT # Make sure nothing comes or goes out of this box $i -A INPUT -j DROP $i -A OUTPUT -j DROP
It's quite a minimal example but it looks like it would do the job. Are there any improvements to be had?