IP Based Allow listing¶
Services like SSH, FTP and SQL are frequently subject to a wide variety of attacks, from brute force attacks to software firewall bypasses and challenge-response exploits. We find that 70% of all Threat Monitoring alerts are caused by brute force attacks, so securing access to these services is critical to ensure your server is safe.
To prevent an attacker from accessing sensitive services like SSH or FTP, we can implement IP based restrictions on a firewall level. This will only allow connections to certain ports from predetermined, safe IP addresses, such as your office IP or developers.
Follow the steps below to implement this, in the example shown we implement IP based restrictions on SSH, which is port 2020 for UKFast servers. Please bear in mind that the steps for dedicated firewalls are different from shared firewalls. We have documented both below. Please ensure you’re following the right guide for your type of firewall.
Dedicated firewalls¶
Under the ‘Products and Services’ ‘Firewall’ section, select ‘Dedicated`.
Select the Dedicated Firewall used for the affected server.
Navigate to the ‘IP Groups Tab.
Press ‘New Non-UKFast Group’
Give this IP group a relevant name.
Give this IP group a description if needed.
Add the IP to restrict access to in the IP address field, set the ‘IP Type’ to ‘Single IP’.
Add the attacking IP address in the ‘IP Address’ field.
Leave a note if required.
You can add additional IP addresses by pressing ‘Add Network Location’
Press ‘Create Group’ To save this IP group.
Navigate to the ‘Port Groups’ Section
Press ‘New Port Group’
Set the ‘Service’ to TCP or UDP as required, most services like SSH and FTP require TCP.
Give this port group a name
Give the port group a description if necessary
Set ‘Port Type’ to ‘Port Number’
Enter the port you wish to secure in both boxes.
Enter a note for these ports if needed.
Press ‘Create group’ to save this port group.
Navigate to the ‘Access Lists’ Section
Press ‘Add incoming Interface Rule’
Set the ‘Action’ Field to ‘Permit’
Set the ‘Source’ Field to the IP Group you just created.
Set the ‘Destination’ to the server you want to secure access to, Or select ‘All Servers’ to secure access from IP across your entire infrastructure.
Set the ‘Ports’ Field to the TCP group you made earlier.
Click the create button.
Add another similar ‘Incoming Interface Rule’, but change the action to ‘Den’ and set the source to ‘anywhere’, ensuring that the destination and ports are the same as the previous access-list rule.
Click the create button.
By clicking and holding the arrows next to the rule in the order column, move the rule to ensure that the Permit rule you just created is at the top of the list and that the Deny rule you just created is directly below it.
Press the ‘Save Changes’ button to apply your configuration.