Site protection: firewall settings

To prevent attacks on the site via direct IP, it is highly recommended to set up a firewall on the server that restricts access to 80/tcp and 443/tcp ports.

Here are the networks that need to be added to the firewall whitelist

77.220.207.0/24
45.10.240.0/24
45.10.241.0/24
45.10.242.0/24
186.2.160.0/24
186.2.164.0/24
186.2.167.0/24
186.2.168.0/24
185.178.209.197/32
190.115.30.44/32

Below are examples of settings for popular firewalls.

Please note that these are sample commands, not a ready-made set of settings for your server — use them only after making sure that they will not break the project.

Example of iptables settings

iptables -I INPUT -s 77.220.207.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 77.220.207.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 45.10.240.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 45.10.240.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 45.10.241.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 45.10.241.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 45.10.242.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 45.10.242.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 186.2.160.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 186.2.160.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 186.2.164.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 186.2.164.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 186.2.167.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 186.2.167.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 186.2.168.0/24 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 186.2.168.0/24 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 185.178.209.197 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 185.178.209.197 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -s 190.115.30.44 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -s 190.115.30.44 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

Example of UFW settings

sudo ufw allow from 77.220.207.0/24 to any port 80 proto tcp
sudo ufw allow from 77.220.207.0/24 to any port 443 proto tcp
sudo ufw allow from 45.10.240.0/24 to any port 80 proto tcp
sudo ufw allow from 45.10.240.0/24 to any port 443 proto tcp
sudo ufw allow from 45.10.241.0/24 to any port 80 proto tcp
sudo ufw allow from 45.10.241.0/24 to any port 443 proto tcp
sudo ufw allow from 45.10.242.0/24 to any port 80 proto tcp
sudo ufw allow from 45.10.242.0/24 to any port 443 proto tcp
sudo ufw allow from 186.2.160.0/24 to any port 80 proto tcp
sudo ufw allow from 186.2.160.0/24 to any port 443 proto tcp
sudo ufw allow from 186.2.164.0/24 to any port 80 proto tcp
sudo ufw allow from 186.2.164.0/24 to any port 443 proto tcp
sudo ufw allow from 186.2.167.0/24 to any port 80 proto tcp
sudo ufw allow from 186.2.167.0/24 to any port 443 proto tcp
sudo ufw allow from 186.2.168.0/24 to any port 80 proto tcp
sudo ufw allow from 186.2.168.0/24 to any port 443 proto tcp
sudo ufw allow from 185.178.209.197 to any port 80 proto tcp
sudo ufw allow from 185.178.209.197 to any port 443 proto tcp
sudo ufw allow from 190.115.30.44 to any port 80 proto tcp
sudo ufw allow from 190.115.30.44 to any port 443 proto tcp
sudo ufw deny 80 proto tcp
sudo ufw deny 443 proto tcp

Example of nftables settings

These rules will work until reboot.

nft add table ip ddg_filter 
nft add chain ip ddg_filter input '{ type filter hook input priority 0; policy accept; }'
nft add rule ip ddg_filter input ip saddr 77.220.207.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 45.10.240.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 45.10.241.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 45.10.242.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 186.2.160.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 186.2.164.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 186.2.167.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 186.2.168.0/24 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 185.178.209.197 tcp dport {80, 443} accept
nft add rule ip ddg_filter input ip saddr 190.115.30.44 tcp dport {80, 443} accept
nft add rule ip ddg_filter input tcp dport {80, 443} drop

These rules will work permanently, if you add to /etc/nftables.conf:

table ip ddg_filter {
        chain input {
                type filter hook input priority filter; policy accept;
                ip saddr 77.220.207.0/24 tcp dport { 80, 443 } accept
                ip saddr 45.10.240.0/24 tcp dport { 80, 443 } accept
                ip saddr 45.10.241.0/24 tcp dport { 80, 443 } accept
                ip saddr 45.10.242.0/24 tcp dport { 80, 443 } accept
                ip saddr 186.2.160.0/24 tcp dport { 80, 443 } accept
                ip saddr 186.2.164.0/24 tcp dport { 80, 443 } accept
                ip saddr 186.2.167.0/24 tcp dport { 80, 443 } accept
                ip saddr 186.2.168.0/24 tcp dport { 80, 443 } accept
                ip saddr 185.178.209.197 tcp dport { 80, 443 } accept
                ip saddr 190.115.30.44 tcp dport { 80, 443 } accept
                tcp dport { 80, 443 } drop
        }
}

Example of firewalld settings

firewall-cmd  --permanent --new-zone=ddg
firewall-cmd  --permanent --zone=ddg --add-port=80/tcp
firewall-cmd  --permanent --zone=ddg --add-port=443/tcp
firewall-cmd  --permanent --zone=ddg --add-source=186.2.160.0/24
firewall-cmd  --permanent --zone=ddg --add-source=77.220.207.0/24
firewall-cmd  --permanent --zone=ddg --add-source=45.10.240.0/24
firewall-cmd  --permanent --zone=ddg --add-source=45.10.241.0/24
firewall-cmd  --permanent --zone=ddg --add-source=186.2.167.0/24
firewall-cmd  --permanent --zone=ddg --add-source=186.2.168.0/24
firewall-cmd  --permanent --zone=ddg --add-source=45.10.242.0/24
firewall-cmd  --permanent --zone=ddg --add-source=186.2.164.0/24
firewall-cmd  --reload

To see the real IP addresses of site visitors, we recommend that you read our instruction "Site protection: restore original visitor IPs"