Possible Duplicate:
Why should I firewall servers?
I have a small server with WEB + FTP. I checked the ports and only 80 + 21 are opened.
So, now the question is, do I really need iptables? These two ports must be opened to everyone, and the others are already closed. I don't think a person could open the ports without a root control(from outside the server). So, is iptables useful for me?
If I understand your question, you don't have any iptables rules and is asking if you really need it if the only open ports you have are the ones from active running services, is it correct?
Short answer: yes you should have a working iptables ruleset on your server, even if the only open ports are the services you want to run there. Also remember to mantain the rules and add/remove services that are added or removed from the server.
Long, exemplified answer: Theoretically you would not need it, but security is about making the attacker's life harder. Suppose that your webserver has a script that with a bug in it, and someone exploits that bug and injects a remote shell server (even a simple netcat will do). If the server doesn't have a firewall on its front or locally blocking connections, the attacker will be able to connect to that exploited shell. If you add correct and working iptables rules, the attacker will not be able to connect (because iptables blocked any traffic not on ports you allowed).
Even if you have a firewall in front of your servers, a basic iptables script is a good practice, as I said, your job is to add layers of security (Defense in depth) so if one layer fails, others will still be up to delay the attack.
No, you don't need to have iptables rules.
However, you will want to have them for several reasons:
See my Community Wiki, "IPTables Tips & Tricks". You might find some inspiration there.
Yes. At the very least, it will open port 20 appropriately so that active FTP will work. Aside from that, it will prevent connections to hostile programs that start a server on your machine.
Iptables should always be running on all public facing servers even if there is a vendor firewall between you and the internet. The key thing to remember with all computer security is that every system can be exploited unless it is powered off. With that in mind you are trying to put barriers in the way of any attacker.
As coredump mentioned in his reply Iptables can help prevent a user space exploit program from running on a high port from accepting connections. It is also possible to prevent your host from talking to specific network segments should you need to with the OUTPUT chain. In addition you can prevent many TCP attacks from being run on your system by using the state module and only allowing related packets by default, then only allowing "new" packets to your web and ftp server.
