08. Firewall Configuration

Firewall configuration translates network policy into enforcement rules. For AI deployments, focus on three areas: protecting AI service ports, controlling outbound connections from AI servers, and restricting management access.

Protect AI service endpoints:

# Allow only authenticated access to Ollama API
# (If using authentication, restrict to auth proxy)
iptables -A INPUT -p tcp --dport 11434 \
    -m state --state NEW \
    -s 10.0.0.0/16 \
    -m recent --set --name OLLAMA
iptables -A INPUT -p tcp --dport 11434 \
    -m state --state NEW \
    -s 10.0.0.0/16 \
    -m recent --update --seconds 60 --hitcount 20 --name OLLAMA \
    -j DROP
# Rate limit to 20 new connections per minute per IP

# Allow web UI if exposed, through WAF/Proxy only
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.100 -j ACCEPT
# Only proxy server can reach AI web UI

Configure fail2ban for AI services:

# /etc/fail2ban/jail.d/ai-services.conf
[ollama-api]
enabled = true
port = 11434
filter = ollama-auth
logpath = /var/log/ollama.log
maxretry = 5
findtime = 600
bantime = 3600
action = iptables-allports[name=ollama-api]

# /etc/fail2ban/filter.d/ollama-auth.conf
[Definition]
failregex = ^.*Invalid API key from <HOST>.*$
            ^.*Authentication failed for.*$
ignoreregex =

Outbound restrictions for AI servers:

AI servers should generally not initiate outbound connections except to authorized internal services:

# Allow AI server to reach internal services only
iptables -A OUTPUT -p tcp --dport 5432 -d 10.0.2.10 -j ACCEPT  # PostgreSQL
iptables -A OUTPUT -p tcp --dport 6379 -d 10.0.2.11 -j ACCEPT  # Redis
iptables -A OUTPUT -p tcp --dport 9200 -d 10.0.2.12 -j ACCEPT  # Elasticsearch
iptables -A OUTPUT -p tcp --dport 22 -d 10.0.0.1 -j ACCEPT     # Management SSH

# Drop all other outbound (no direct internet access)
iptables -A OUTPUT -j DROP

IPv6 considerations:

# Also configure IPv6 firewall
ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT