IPtables blocking SSH, even after its been implicitly enabled?

Question

Im having trouble with the following iptables entries. I want to stop the server from communicating with the outside world except for ssh, but when I enter the fourth command (iptables -P OUTPUT DROP) I lose my SSH connection, even though ive left it open. Any help would be greatly appreciated?

iptables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT  
iptables -A OUTPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT
iptables -A FORWARD -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

thanks

Answer 1

Try instead, in line 2:

iptables -A OUTPUT -p tcp -m conntrack --ctstate ESTABLISHED --sport ssh -j ACCEPT

Assuming that when you say "stop the server from communicating with the outside world except for ssh", you mean "stop the world from communicating with the server except via ssh", then the outbound packet comes from the ssh server so has --sport 22, not dport.

If you really do mean that you should only be able to talk from the server to the world via ssh, then line 1 should have the --sport instead, as the INPUT packets are those coming from an ssh server.

If you want ssh to work in both directions, you'll need more complex rules. If you want to allow new ssh connections, not just the one that's open when you put the ruleset in place, you'll need more complex rules.

Answer 2

I am assuming that the iptables rules are on your server, and your question means you only want to allow SSH connections into that server. Let's analyze your rules:

iptables -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT

This rule means: only TCP connections already in "ESTABLISHED" state can connect to the SSH port. This effectively blocks all connection attempts to SSH, because when someone (you) want to connect to the SSH port, the state is still "NEW" instead of "ESTABLISHED"

iptables -A OUTPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT

This rule means: only allow access from the server to an SSH port, and only allow "ESTABLISHED" TCP connections. So, that's a type: --dport should be --sport

iptables -A FORWARD -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --dport ssh -j ACCEPT

If your server is not functioning as a router, you don't need a FORWARD rule.

iptables -P OUTPUT DROP
iptables -P FORWARD DROP

The basic and recommended 'hardening', dropping all traffic not explicitly allowed.

---

The correct rules

So, you must change your rules into the following:

iptables -A INPUT  -p tcp --dport ssh -j ACCEPT  
iptables -A OUTPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED --sport ssh -j ACCEPT
iptables -P INPUT  DROP
iptables -P OUTPUT DROP

1. Allow all attempts to connect to the SSH port

2. Allow all replies (TCP state == ESTABLISHED) from the SSH port

3. Drop all other connection attempts

4. Drop all other traffic coming out of the server

Important Notes:

1. Usually you will want to allow ICMP coming in and out of your server

2. Usually the OUTPUT chain has a default policy of ACCEPT instead of DROP

Answer 3

Try this:

Allow SSH on certain ephemeral ports only

iptables -A INPUT -p tcp --sport 513:65535 --dport 22 -j ACCEPT

iptables -A OUTPUT -p tcp --sport 22 --dport 513:65535 -j ACCEPT

iptables -A OUTPUT -p tcp --sport 513:65535 --dport 22 -j ACCEPT

iptables -A INPUT -p tcp --sport 22 --dport 513:65535 -j ACCEPT

Make sure nothing enters or leaves this box

iptables -A INPUT -j DROP

iptables -A OUTPUT -j DROP