Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -4 down vote favorite

I've got a centOS virtual box with GoDaddy. By Default no firewall is enabled.

To the point: I want to set up the regular firewall set up. I however modified the SSH and FTP ports to custom ports rather the default. When I ran system-config-securitylevel-tui I chose FTP, and etc... and saved it. I then looked at the raw config file, and they showed the standard ports for ssh / ftp. So I obviously went ahead and added those two ports to the custom list as: XXXX:tcp, XXXX:tcp, etc...

I don't want to enable it and restart and end up not being able to access the server (locking myself out).

Could someone verify ?

Thanks

share|improve this question
1  
Without posting any details (read: config files), how do you expect any of us to verify anything? – EEAA Mar 12 '11 at 19:48
4  
@Michael - being belligerent is going to do you no favors here. When asking questions, it's expected that you give us enough information to give good answers. In your case that hasn't happened. If you want good answers, give good questions. Post your config (or a sanitized version if necessary) and we'll do our best to verify. – EEAA Mar 12 '11 at 19:58
3  
@Michael - sounds like either you don't know how to post your config or you aren't willing to do what it takes to get a good answer. As you can see from my user page, I've been around the block a few times - I know how things work here, and I know a good question from a bad question. Good luck getting a suitable answer. Does GoDaddy not give you out-of-band console access? That's the real solution to this problem. With that, you'd be able to make this change without being worried about getting locked out. – EEAA Mar 12 '11 at 20:07
2  
@Michael - I'm not sure how many times I'm going to need to repeat this - nothing short of posting your config is going to get you a for-sure answer on whether or not you risk locking yourself out. Posting a link to a generic how-to does not help us sanity-check your configuration. Honestly - I'm willing and trying to help you, but it appears as if you don't really want to be helped. – EEAA Mar 12 '11 at 20:12
1  
Use firehol instead of manually creating your rules. It has a method for you to try a new rule set safely. If you create a set of rules that disconnect you, then they will revert. – Zoredache Mar 12 '11 at 21:46
show 7 more comments

2 Answers

up vote 1 down vote accepted

If your iptables include a line to ACCEPT connection states related and established and you are already connected to the host, you will not be locked out:

# iptables -A INPUT -m state --state established,related -J ACCEPT

If you want to be extremely cautious, do what I do when testing rules:

# iptables-restore < iptables_rules; sleep 30; iptables-restore < clean_rules

The idea is apply the rules, wait 30 seconds and apply a set of rules to allow all access. When you execute this line, press enter a couple of times and two things can happen:

  • Your rules locked you out (pressing enter does not show on the screen, so wait the time to run out and they will be cleared;
  • If your rules work and you can see the new lines on the screen, CTRL+C before the sleep ends and you're good.
share|improve this answer
I think IPTABLES are not his problem and more over in your rule you did not mentioned any thing about state NEW.He seems to change the port from 22 to some thing else and he is not able to login.I think that is the problem. – Registered User Mar 12 '11 at 20:43
Thanks @coredump; the sleep will do exactly what i'm lookin for – Michael Mikhjian Mar 12 '11 at 20:46
@regis If I put new on that specific rule I would allow ANY new connection, and that's not the point. I add new to any rule that has a point, like one allowing access to a port or from a determined address. – coredump Mar 12 '11 at 21:59
up vote 0 down vote

Did you restart the ssh daemon after applying the rules if yes then did it cleanly happened.

What is the output of following command 

 netstat --inet -pln | grep (your SSH port)

Do you see any thing like 

      Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1089/sshd

Replace 22 by your SSH port in above. Do you see SSH or any other service listening to the ports you changed in netstat's output? Which config file you changed and what was the change you did?

What is the output of 

iptables -L -v -n

UPDATE
Apart from what coredump said it is a practice among sysadmins to have a cron job entry which deletes your firewall after 15 minutes when you applied.So this way if you really did some thing wrong after 15 minutes cron will flush those rules and you can check again.Like this when you have tested things then you can delete this cron job entry and permanently set the firewall as you wish.

share|improve this answer
@Michael what is the output of netstat ? is there any daemon listening to your changed port your firewall has no meaning. – Registered User Mar 12 '11 at 20:55
netstat came out normal; i was actually able to verify another process through godaddy *via there team; unfort – Michael Mikhjian Mar 12 '11 at 21:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.