1.Default Firewall Settings

In Interspace Cloud, the network traffic to and from your virtual servers is not filtered or blocked by any firewall located before your virtual server network interfaces. While this offers maximum flexibility for your traffic security configuration, it is your responsibility to set up a firewall in the operating system of your virtual server.

If your server is accessible from the Internet, we strongly recommend setting up a firewall. You should configure the firewall immediately after deploying a new virtual server, before installing any applications or making services available.

Don't think hackers will not attack your server just because the chances of finding your public IP address are small. They use automated bots that continuously scan the entire internet looking for vulnerable servers. Your server can be discovered and attacked within hours after going online.

For Linux systems, you can use iptables, ufw or firewalld, while Windows servers come with Windows Defender Firewall. Please read the Best Practices for Firewall Security section below.

2.Best Practices for Firewall Security

2.1.Allow Only Required Ports

Each open port is a potential entry point for attackers. Keep only those ports open that are necessary for your services to function.

Configure your firewall to block all incoming traffic by default and only allow specific required services. This "deny all, permit some" approach is much safer than trying to block specific threats. The fewer open ports you have, the smaller the chance of unauthorized access to your server.

2.2.Secure Management Access

Change default ports for management services like SSH (22) and RDP (3389). While this alone won't stop determined attackers, it helps reduce automated scanning attempts.

When possible, restrict access to management ports to specific IP addresses or ranges. This significantly reduces the risk of unauthorized access attempts.

For additional security, consider implementing port knocking. This method keeps ports closed until a specific sequence of connection attempts is detected. Only after this "secret knock" will the firewall temporarily open the required port.

2.3.Rate Limiting

Configure your firewall to limit the number of connections from a single IP address. This helps prevent brute force attacks and denial of service attempts.

Common targets for rate limiting are SSH, RDP, and web application login pages.

2.4.Geo-blocking

Consider blocking traffic from countries where you don't conduct business. While not foolproof, this can significantly reduce the number of attacks.

2.5.Firewall Log Monitoring

Review your firewall logs periodically to identify unusual patterns or repeated access attempts. This can help you detect potential security threats and adjust your rules accordingly.