Name: Linux Firewalls
ISBN: 9780672327711

What Hacker News says

rfmozFeb 2026

Linux Firewalls by Steve Suehring covers nftables. It’s a good book to know the basics.

jcynixJun 2024

I've been running self-hosted servers for the last 25+ years without an incident and its less complicated than it might seem if you learn a bit about securing unix-based systems (ok, I already had 10+ years of server admin knowhow for various systems, but anyway, it's not rocket science ;-). Yes, an hour or so after you connect any machine to the Internet, you'll see attempts to "talk" to your server. So don't wait to set up basic security. But it actually has never been so easy to "just give it a try" (see below), with all the virtual offerings today. So here's a short/raw sketch of basic things you'd need to do:

1. 25+ years ago I used http://easyfwgen.morizot.net/ to generate an iptables based local firewall. Still works fine (then and now tweaking some things) and allows only certain ports too be accessed at all. I just open email, ssh and a web server.

The generator is well documented and still works, although it would be nice to see an updated version to newer firewall software like pf.

2. server configs:

edit /etc/hosts.deny --> restrict all by default

  ALL: ALL

edit /etc/hosts.allow --> allow your service providers networks, e.g.

  sshd: .t-dialin.net
  sshd: .dip0.t-ipconnect.de

So you can connect to your machine for further setup, but not the whole world.

3. set up sshd:

edit /etc/ssh/sshd.config

  # allow key-based access only
  PasswordAuthentication no

Maybe change sshd's port (reduces log file entries) but don't forget to allow this port in your iptables setup and your /etc/hosts.allow

People have opinions an key-based access, I know. But my private and public key is stored in various secure locations, including my phone (password safe) and I can access my server even from my Android phone or tables via Termux.

4. set up email (I suggest postfix as an MTA):

configure restrictions in /etc/postfix/main.cf, e.g.

  # restrictions in the context of the RCPT TO command
  smtpd_recipient_restrictions =
        reject_invalid_hostname,
        reject_non_fqdn_hostname,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        check_sender_access hash:/etc/postfix/sender_access,
        reject_unknown_sender_domain,
        reject_unknown_recipient_domain,
        permit_mynetworks,
        reject_unauth_destination,
        [...]

  # restrictions for clients connecting
  smtpd_client_restrictions =
        reject_unauth_destination,
        check_client_access hash:/etc/postfix/access_client,
        reject_unknown_client,
        reject_unauth_pipelining

This heavily reduces the amount of spam you'll see. I add greylisting too, as this even nowadays reduces even more unwanted traffic. Combine that with spamassassin if you like. This setup gives me maybe one spam per day reaching my inbox (actually the spam subfolder).

5. Learn by doing (not just reading stuff on the Internets ;-), that is, set up a machine, e.g.

If you'd like to experiment a bit, take a look at Hetzner's unexpensive cloud servers, these are easy to set up (incl. a virtual firewall in front of it) and take down after some experiments of a failure. You can do this in Hetzner's web interface, even if you misconfigure your server to be unaccessible. Cf.

https://docs.hetzner.com/cloud/servers/overview/

Tip: Hetzner's web interface allows you to pre-define an ssh key which they'll install automatically on your new machine (but they leave password login enabled, so change that asap).

Disclaimer: I'm just a happy customer, no other relation. And it might be as easy to do this with Digital Ocean, which have some nice tutorials too, for example on the set up of a web server:

https://www.digitalocean.com/community/tutorials/how-to-inst...

Last but not least No Starch Press overs some nice books like "How Linux Works" or "The Linux Command Line" (if you're not sure about that) or even "Linux Firewalls: Attack Detection and Response" ...

You learn most by trying.

I'm now heading for the beach to enjoy some offline adventures and will answer questions later if needed.

thread

popcalcOct 2022

Wireguard docs are useful: https://www.wireguard.com/netns/

If you want to RUN a VPN, master iptables and enterprise networking: https://www.amazon.com/Linux-Firewalls-3rd-Steve-Suehring/dp... .

If you want to WRITE a VPN, read the source of a few openly available relatively simple VPN/tunnel implementations.

https://github.com/yarrick/iodine https://github.com/jpillora/chisel

Familiarise yourself with packet layers. Fantastic resource: https://github.com/netspooky/protocols/tree/main/broadcast_b...

thread