Blog

Advanced Security Setup for Odoo Server Using iptables

This tutorial will guide you through configuring iptables for your Odoo server to allow secure HTTPS access, restrict SSH access to a specific client, and implement advanced security measures to mitigate DoS attacks and log unauthorized access attempts.

---

Step-by-Step Configuration

1. Allow Incoming HTTPS Traffic

To allow secure access to your Odoo server over HTTPS (port 443), run the following command:

sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

2. Allow SSH Access from a Specific Client

If you have a specific client with a static IP address (e.g., 192.168.1.50) that needs SSH access on port 50111, use this command:

sudo iptables -A INPUT -p tcp -s 192.168.1.50 --dport 50111 -j ACCEPT

3. Allow Established Connections

To maintain ongoing sessions, allow established and related connections:

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

4. Rate Limiting for SSH

To prevent brute-force attacks on your SSH port, implement rate limiting:

sudo iptables -A INPUT -p tcp --dport 50111 -i eth0 -m conntrack --ctstate NEW -m recent --set
sudo iptables -A INPUT -p tcp --dport 50111 -i eth0 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 5 -j DROP

5. Log Dropped Packets

To monitor and analyze dropped packets, add a logging rule before the DROP rule:

sudo iptables -A INPUT -j LOG --log-prefix "IPTables-Dropped: " --log-level 4

6. Drop All Other Incoming Traffic

To enhance security, drop all other incoming traffic that is not explicitly allowed:

sudo iptables -A INPUT -j DROP

7. Drop Invalid Packets

To filter out malformed packets, add this rule:

sudo iptables -A INPUT -m state --state INVALID -j DROP

8. Save Your Rules

After configuring your rules, save them to ensure they persist after a reboot:

sudo iptables-save | sudo tee /etc/iptables/rules.v4

---

Summary of Commands

Here’s a complete summary of the commands for your advanced security setup:

# Allow HTTPS traffic
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow SSH access from a specific client
sudo iptables -A INPUT -p tcp -s 192.168.1.50 --dport 50111 -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Rate limiting for SSH
sudo iptables -A INPUT -p tcp --dport 50111 -i eth0 -m conntrack --ctstate NEW -m recent --set
sudo iptables -A INPUT -p tcp --dport 50111 -i eth0 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 5 -j DROP

# Log dropped packets
sudo iptables -A INPUT -j LOG --log-prefix "IPTables-Dropped: " --log-level 4

# Drop invalid packets
sudo iptables -A INPUT -m state --state INVALID -j DROP

# Drop all other incoming traffic
sudo iptables -A INPUT -j DROP

# Save the rules
sudo iptables-save | sudo tee /etc/iptables/rules.v4

Monitoring Logs

To monitor the logs for dropped packets, you can check the system log file:

sudo less /var/log/syslog

Look for entries prefixed with “IPTables-Dropped:” to see the logged attempts.

By following this tutorial, you will have set up an advanced security configuration for your Odoo server using iptables, allowing secure HTTPS access while restricting SSH access and implementing measures to mitigate DoS attacks.