Shortest iptables command allowing only ssh access

Question

When building a new system I do not turn on the network until I have configured iptables to prevent all inbound traffic except on port 22 (ssh). Later, I open up ports and configure allowed address ranges.

What is the shortest iptables command I can type to disallow all inbound traffic except connections to port 22 from a (given) single IP address?

Answer 1

# flush rules 
iptables -F INPUT
iptables -P INPUT DROP
# allow loopback traffic
iptables -A INPUT -s lo -j ACCEPT
# allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# allow ssh
iptables -A INPUT -s 10.15.10.0/24 -p tcp --dport 22 -j ACCEPT

Answer 2

I'm not great on the actual commands, but my iptables file would look like this:

#Filter all previous rules

*filter

# Loopback address

-A INPUT -i lo -j ACCEPT

# Established inbound rule for eth+ connections

-A INPUT -i eth+ -m state --state RELATED,ESTABLISHED -j ACCEPT

# Allow ssh access

-A INPUT -i eth+ -s X.X.X.X/Y -p tcp --dport 22 -j ACCEPT

# Explicit rules at the end

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT ACCEPT [0:0]

COMMIT

Answer 3

iptables -F
iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp -j DROP

Very similar to @pQd (vote him up not me), but I hate DROP policies - I think they're bad practice.