I'm creating some firewall rules for a VPS using iptables. My shell script looks something like this:
#!/bin/sh
# My system IP/set ip address of server
SERVER_IP="1.2.3.4"
# Flushing all existing rules
iptables -F
iptables -X
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Allow SSH on 22
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
# Default policy DROP
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
If i run the iptables -F
command after running this script I get locked out of SSH (I can get back in, but I never want the SSH to go down).
I have three questions.
- Am I being locked out by the default filter policies not being removed when I run the
iptables -F
command? - Will I not get locked out if I do
iptables -FX
? - Are the default filter policies even necessary if I'm adding the default drop policy at the end of the shell script anyway?
Cheers!
trap '' EXIT
andtrap '' SIGHUP
in their at the top. It will make the script run to completion even if you kill your connection.