Firewall setup + security on remote server

To ansswer my own question, I went with shorewall, and took a chance after in general following the instructions in the shorewall section here. I didn't lock myself out, and it seems to be working.

Two important things to note when setting it up initially.

The rules file is the first thing checked - if there's a matching rule found there then none of the other stuff in the zones or policy files are checked.

So add the entry:

SSH/ACCEPT net $FW

to your rules file, to ensure that no matter what else, you can still access your server through ssh.
Of course, this is also saying that ssh connections will be accepted from anywhere, so you might want to narrow that down later.


The other thing is the routestopped file, which determines what traffic is allowed while the firewall is in a 'stopped' state.
Add:

eth0    a.b.c.d/blah

replacing a.b.c.d/blah with the IP address (if static) or netmask (if dynamic) you connect from.

Finally, always run shorewall check before restarting shorewall to validate that your config files are correct.

That should (hopefully) help stop you locking yourself out while configuring shorewall (though I make no guarantees!).


(Also, if you are following that guide, don't forget to do the last shorewall bit where you enable ping and mail - I spent 2 hours trying to get my mailserver set up before copping on that the firewall was blocking inbound mail).