Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im having trouble with the following iptables entries. I want to stop the server from communicating with the outside world except for ssh, but when I enter the fourth command (iptables -P OUTPUT DROP) I lose my SSH connection, even though ive left it open. Any help would be greatly appreciated?

iptables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT  
iptables -A OUTPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT
iptables -A FORWARD -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

thanks

share|improve this question

3 Answers 3

Try instead, in line 2:

iptables -A OUTPUT -p tcp -m conntrack --ctstate ESTABLISHED --sport ssh -j ACCEPT

Assuming that when you say "stop the server from communicating with the outside world except for ssh", you mean "stop the world from communicating with the server except via ssh", then the outbound packet comes from the ssh server so has --sport 22, not dport.

If you really do mean that you should only be able to talk from the server to the world via ssh, then line 1 should have the --sport instead, as the INPUT packets are those coming from an ssh server.

If you want ssh to work in both directions, you'll need more complex rules. If you want to allow new ssh connections, not just the one that's open when you put the ruleset in place, you'll need more complex rules.

share|improve this answer

I am assuming that the iptables rules are on your server, and your question means you only want to allow SSH connections into that server. Let's analyze your rules:

iptables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT

This rule means: only TCP connections already in "ESTABLISHED" state can connect to the SSH port. This effectively blocks all connection attempts to SSH, because when someone (you) want to connect to the SSH port, the state is still "NEW" instead of "ESTABLISHED"

iptables -A OUTPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT

This rule means: only allow access from the server to an SSH port, and only allow "ESTABLISHED" TCP connections. So, that's a type: --dport should be --sport

iptables -A FORWARD -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT

If your server is not functioning as a router, you don't need a FORWARD rule.

iptables -P OUTPUT DROP
iptables -P FORWARD DROP

The basic and recommended 'hardening', dropping all traffic not explicitly allowed.


The correct rules

So, you must change your rules into the following:

iptables -A INPUT  -p tcp --dport ssh -j ACCEPT  
iptables -A OUTPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --sport ssh -j ACCEPT
iptables -P INPUT  DROP
iptables -P OUTPUT DROP
  1. Allow all attempts to connect to the SSH port

  2. Allow all replies (TCP state == ESTABLISHED) from the SSH port

  3. Drop all other connection attempts

  4. Drop all other traffic coming out of the server

Important Notes:

  1. Usually you will want to allow ICMP coming in and out of your server

  2. Usually the OUTPUT chain has a default policy of ACCEPT instead of DROP

share|improve this answer

Try this:

Allow SSH on certain ephemeral ports only

iptables -A INPUT -p tcp --sport 513:65535 --dport 22 -j ACCEPT

iptables -A OUTPUT -p tcp --sport 22 --dport 513:65535 -j ACCEPT

iptables -A OUTPUT -p tcp --sport 513:65535 --dport 22 -j ACCEPT

iptables -A INPUT -p tcp --sport 22 --dport 513:65535 -j ACCEPT

Make sure nothing enters or leaves this box

iptables -A INPUT -j DROP

iptables -A OUTPUT -j DROP

share|improve this answer
    
Thats great!!! Just wondering if anyone can tell me why ctstate RELATED, ESTABLISHED doesnt/didnt work for me? –  markymark Mar 30 '11 at 6:32
    
No problem. I was going to point out the --sport and --dport typo but thought you'd prefer something a bit safer if you're completely locking your box down. Sometimes these 'extras' like RELATED and ESTABLISHED need other iptables modules loaded so maybe they're not loaded into memory so I left them out. –  Jonathan Ross Mar 30 '11 at 6:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.