How to Secure Hermes on a Debian 12 VPS

After deploying Hermes, it is critical to secure your VPS. This guide covers restricting SSH access to port 8288 using iptables with a whitelisted IP, and verifying your public IP address.

Prerequisites

Ensure you have SSH access to your VPS and that you know your public IP address. If you are unsure, you can check it using myip.dk:

curl -s https://myip.dk | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | head -1

Alternatively, visit https://myip.dk in your browser. Your public IP will be displayed.

For this guide, we will use the following dummy IP as an example of an allowed client address:

203.0.113.45

Important: Replace this dummy IP with your actual public IP before applying the rules. Failure to do so will lock you out of your server.

Step 1: Install iptables-persistent

To ensure your firewall rules survive a reboot, install the persistence package:

apt update
apt install -y iptables-persistent

During installation, you will be prompted to save current rules. Choose Yes for both IPv4 and IPv6.

Step 2: Set Default Policies

Set the default policy to drop all incoming traffic unless explicitly allowed. This follows the principle of least privilege.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

Step 3: Allow Essential Traffic

Allow loopback and established connections so the system functions correctly:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Step 4: Restrict SSH Port 8288 to Your IP Only

Add a rule that allows SSH connections on port 8288 only from your whitelisted IP. Using the dummy IP from above:

iptables -A INPUT -s 203.0.113.45/32 -p tcp --dport 8288 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

If you need to allow an entire subnet instead of a single IP, adjust the source address and CIDR notation accordingly (e.g., 203.0.113.0/24).

Step 5: Save the Rules

Persist the iptables rules so they are applied automatically on boot:

netfilter-persistent save

Alternatively, you can manually save:

iptables-save > /etc/iptables/rules.v4

Step 6: Verify the Rules

List the current iptables rules to confirm your configuration:

iptables -L INPUT -n -v --line-numbers

Look for the rule that accepts TCP traffic on port 8288 from your whitelisted IP. Ensure there is no rule above it that drops or rejects the connection.

Step 7: Test the Configuration

From a different machine (not the VPS itself), attempt to connect to port 8288 using your whitelisted IP. If the connection succeeds, the rule is working.

From a machine with a different IP, the connection should be refused or timed out.

Warning: Do not close your current SSH session until you have confirmed that you can open a new SSH connection on port 8288 from your whitelisted IP. If you lock yourself out, you will need to use your VPS provider's console (VNC) to recover access.