Just install ufw. It's very simple to configure the rules for a basic server. Here's how: https://www.digitalocean.com/community/articles/how-to-setup...
> There is a lot of functionality built into these
> utilities, iptables being the most popular nowadays, but
> they require a decent effort on behalf of the user to
> learn and understand them.
I'd rather use pf on BSD though.
Simple is being able to simply say "allow all outgoing traffic and incoming traffic should only be allowed for HTTP(S) and SSH" and being able to figure out how to do it by just invoking "ufw --help".
Maybe someday I'll learn about iptables, I'm sure it's going to be worth it, but for now ufw does the job for me.
> Maybe someday I'll learn about iptables
Hmm...
iptables -A INPUT -p tcp --dport 22 -j ALLOW
iptables -A INPUT -p tcp --dport 80 -j ALLOW
iptables -A INPUT -p tcp --dport 443 -j ALLOW
iptables -A INPUT -p icmp -j ALLOW
iptables -A INPUT -i eth0 -j DROP
Indeed, it is. Even if you want to cargo cult that without understanding it, you might get bitten because running those commands again will not do what you expect, since they're not idempotent.
You will now reply telling me how to deal with this situation, for example if I want to now listen on a different port, or how I get FTP (or some other protocol that needs "-m state" to work. The need to do this proves that using iptables is more complicated that your example.
You should still understand iptables but you do not need to config everything manually.