10

TL:DR

I made changes to my iptables config and now SSH is refusing all connections. Can I fix this without contacting my hosting company?

Long Version

Ok, this is most likely 100% my own fault...

In preparation of moving a website to a dedicated server, we got a new hosted machine running CentOS 5.6. The machine has iptables pretty locked down, only allowing ssh(22) and http(80) but we also needed it to accept FTP over port 20 en 21.

This afternoon I added to lines to my iptables in order to accept incoming connection to ports 20 and 21. At first that didn't work because there was a reject allline above the lines I added for ftp. So I moved that line down to the bottom, saved and restarted iptables and ftp was working.

2 hours later, when I try to connect again, port 22: Connection refused Same for http.

So I can't get to the server through SSH, is there any way I can fix this without contacting my hosting company?

Improve this question
0

4 Answers 4

Reset to default
13

Unfortunately, no. Not unless you have some other management interface available like a remote serial console, iDRAC, iLO, etc. Chalk it up to experience and remember to test settings before you log out next time ;)

Improve this answer
4
  • 12
    Or if you experiment with iptables make sure that you temporarily set a cron job that resets the ruleset every 15 minutes.
    – mailq
    Aug 12, 2011 at 19:10
  • 1
    Lesson learned :)
    – Jan Henckens
    Aug 12, 2011 at 19:24
  • How would you enable the SSH port 22 using iDRAC?
    – terrid25
    Aug 31, 2011 at 13:39
  • @terrid25 you would login using the serial console listening on the serial port that iDRAC gives you access to. you can then fix iptables and be on your merry way. of course, if your out-of-band stuff isn't set up with remote console and such you'll be just as stuck as your friend with no remote management at all.
    – Michael Lowman
    Sep 1, 2011 at 3:28
8

Assuming you can still ftp to the server, and you can log in as root via ftp (unlikely and ordinarily ill-advised) into a non-chrooted (etc) environment:

Put a file in /etc/cron.d with these contents:

* * * * * root /sbin/service iptables stop
Improve this answer
1
  • This helped me, because I can remotely connect a recovery image and access the filesystem.
    – Daniel W.
    Jun 7, 2015 at 11:57
0

As per these instructions, you can also append:

scripts2/doautofixer?autofix=iptablesflush

... to your WHM url. I did that and ended up with a URL:

https://mysite:2087/SESSION_ID/scripts2/doautofixer?autofix=iptablesflush

It reset my iptables and everything was good with the world again. :)

Improve this answer
0

In CentOS you have the file /etc/sysconfig/iptables if you don't have it there, you can create it simply by using iptables-save to dump the current rule set into a file.

iptables-save > /etc/sysconfig/iptables

To load the file you don't need to restart the machine, you can use iptables-restore

iptables-restore < /etc/sysconfig/iptables
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .