Ytdyklly

A while ago, I ran a vino server inside my local wifi network, and the vino server wrote messages on stdout that some strange IPs from the Internet tried to connect to it. I wondered, "Is my server being Attacked". How can you secure your server on local and nonlocal, and public and private networks not under your control?

Is the following a possible idea?
Is there a way to make the server only accessible to the other processes running on the server host, and run sshd on the server host to allow forwarded access? (I guess the idea from: https://help.ubuntu.com/community/VNC#SSH_port-forwarding. I don't quite understand how it is done and hope you could explain.)

• Does this make other machines only able to connect to the server by using ssh and port-forwarding/tunneling?




• Does this way make the server only accessible to the machines in the same local network or does is also allow machines outside the local network?




• Is it a more secured way to access the server than making the server accessible to all the other machines in the local network? If yes, is it more secured because SSH is usually more secured than other protocols. (Such as the protocol used by vino?)

Thanks.

IP tables can get this job done. It is basically a firewall.

iptables are installed by default on most linux systems. However you can manually install it:

apt-get install iptabels

You can configure it, To Only Allow the local host Access to the Ports and Services, by implementing the following: (This makes processes only available to the host they are running on.)

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT DROP

iptables -A INPUT -i lo -j ACCEPT

iptables -A OUTPUT -o lo -j ACCEPT

From there you could add allowances for other ports and services. If you need Internet on that machine while you look for the services and ports you want to allow and how to do it don't use iptables -P OUTPUT DROP yet, put that in place last. Here are good sites to learn from:

Iptables Examples

Allow only SSH

To save the firewall between boots, install iptables-persistent then do iptables-persistent save or netfilter-persistent save.

Doing the first process described here will make your machine, only accessible to it self. The SSH only method will only allow SSH conections to the machine and only from the local network, unless you port-forward the SSH port from your router to that machine from the outside, then all you need is a diydns or no-ip type service or constantly know your public IP to get access from the outside.

Doing the things described in the Allow SSH Only link then port forwarding through a ssh tunnel to the service, is more secure. It only allows SSH connections. It is best to use key based authentication vs passwords however.