up vote 3 down vote favorite
share [g+] share [fb]

Is there a way to deny all external traffic (WAN) to SSH and allow only local traffic (192.168.0.1 to 192.168.0.255) and what would be the rule? Thanks

Edit:

I think I found a way, please feel free to close it if needed.

iptables -A INPUT -p tcp -m state --state NEW --source 192.168.0.1/24 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
link|improve this question
1  
You should post your solution as an answer then accept it. – Iain♦ Dec 31 '10 at 20:16
feedback

1 Answer

up vote 2 down vote 
iptables -A INPUT -p tcp -m state --state NEW --source 192.168.0.1/24 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
link|improve this answer
1  
I'm assuming you have a rule up the INPUT chain that accepts ESTABLISHED traffic already. That would be crucial. Just FYI for anyone else attempting to use this answer. – Beaming Mel-Bin Dec 31 '10 at 22:33
@Nimmy Lebby: That may be a questionable assumption, considering the answer also includes a --source with a malformed network range. I believe iptables will interpret it as 192.168.0.0/24, which, fortunately, seems to be the desired range. IMO, this question and answer seem to have garnered more than a few egg-nog inspired upvotes. – Steven Monday Jan 1 '11 at 1:43
I was going to comment on the network address as well but I have tested it and, yes, your belief on the iptables interpretation is correct. And I wish I had some eggnog myself. – Beaming Mel-Bin Jan 1 '11 at 1:46
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.