Blog

To secure your on-premise Odoo Installation from hacker attacks it is highly recommended to set up a firewall.

Here we present a basic setup using iptables. It’s a powerful tool for managing network traffic and is widely used in Linux environments. Here’s a breakdown of how to get started.

Why Use iptables?

• Flexibility: You can create complex rules tailored to your needs.
• Control: It allows you to specify which traffic is allowed or denied.
• Widely Supported: Most Linux distributions, including those for Raspberry Pi, support iptables.

Installing iptables

sudo apt update 
sudo apt install iptables

Basic iptables Commands

Here are some basic commands to get you started with iptables:

1. View Current Rules:

sudo iptables -L -v

Allow Incoming Traffic on Specific Ports (e.g., Odoo typically runs on port 8069. If you run Odoo on a reverse proxy you’ll need to open ports 80 or 443 as well):

sudo iptables -A INPUT -p tcp --dport 8069 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Allow SSH Access (important for remote management):

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Tip:

To enhance security, we recommend changing the SSH port, enable passphrase authentication, and disable password login, when setting up the SSH Server.

Drop All Other Incoming Traffic:

sudo iptables -A INPUT -j DROP

Make sure that the rules for ports 8069, 443, and 22 are listed before the DROP rule. The order of the rules is crucial because iptables processes rules from top to bottom.

Save Your Rules (to persist after reboot):

sudo iptables-save | sudo tee /etc/iptables/rules.v4

Restore Rules on Boot: You can use a package like iptables-persistent to automatically load your rules on boot:

sudo apt-get install iptables-persistent

Testing Your Configuration

After setting up your rules, you can test them by trying to access your Odoo server from another device on the same network. Make sure you can connect via SSH as well. If you encounter issues, you can temporarily flush all rules with:

sudo iptables -F

This will remove all rules, allowing you to troubleshoot.

Additional Considerations

• Logging: Consider adding logging rules to monitor dropped packets. This can help you understand what traffic is being blocked.
• Backup: Always back up your current iptables configuration before making changes.
• Documentation: Familiarize yourself with the iptables documentation for more advanced configurations.

By starting with these basic commands and gradually adding complexity, you can build a robust firewall setup for your Odoo server.