Let's Encrypt and Firewall rules

Server
1

Hello,
I would need some help about allowing let’s encrypt to work properly on my server. I had to allow All incoming trafic and all outgoing trafic in order to make the issuance of my cert.

But i would like to drop back all default trafic so what do I need to allow in IPTABLES in order to let certbot works (i did the automated install).

Thanks

2

I have not done any tests to confirm this, but here’s what I think ought to be the the minimum set of firewall rules you need for Let’s Encrypt:

  • For all challenge types: Allow outgoing traffic to acme-v01.api.letsencrypt.org on port 443 (HTTPS).
  • For HTTP-01 (for example via certbot's webroot plugin): Allow incoming traffic on port 80 (HTTP) from anywhere.
  • For TLS-SNI-01 (for example via certbot's standalone or apache plugin - this is probably what you used, if I’m interpreting “automated install” correctly): Allow incoming traffic on port 443 (HTTPS) from anywhere.

In case you’re wondering why it’s “anywhere” for HTTP-01 and TLS-SNI-01, and not a set of specific IPs: Let’s Encrypt plans to perform validation requests from a number of (possibly) unpredictable IP addresses in the future, in order to make spoofing validation requests harder. If you rely on a specific IP address being used, your deployment will break without any warning at some point.

If you’re looking for a challenge type that does not require allowing any incoming traffic, take a look at DNS-01. With that challenge type, domain ownership is demonstrated via a TXT record you create for your domain. Note that this is currently not supported by certbot, you’d have to use one of the alternative clients (take a look at lego or any of the bash clients).

3 Likes
3

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.