Help With IPtables And SSH Connection on Ubuntu VPS

Question

Looking for help with a VPS config. I am a web developer that is trying to configure a 64 bit Ubuntu VPS. I changed the SSH port to 30000, added a user with all privileges and have set up the IPtables using the following script

*filter

#  Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT

#  Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allows all outbound traffic
#  You could modify this to only allow certain traffic
#  This is in addition to allowing established and related traffic as listed above
-A OUTPUT -j ACCEPT


# Allows HTTP and HTTPS connections from anywhere (the normal ports for websites)
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT


#  Allows SSH connections from trusted-host only - drop the rest
#
# CHANGE THE TRUSTED-HOST DETAILS AFTER THE WORD --source
# THE -dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE
#
-A INPUT -p tcp -m state --state NEW --source mydomain.com --dport 30000 -j ACCEPT
-A INPUT -p tcp --dport 30000 -j DROP

# Create time lock for non-wanted SSH attempts of a period of 1 minute
-A INPUT -p tcp -m state --syn --state NEW --dport 30000 -m limit --limit 1/minute       --limit-burst 1 -j ACCEPT
-A INPUT -p tcp -m state --syn --state NEW --dport 30000 -j DROP


# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT


# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7


# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

When I try to SSH using the standard ssh command I get a connection refused error which is to be expected but when I try this command, the terminal seems to hang and becomes unresponsive and no connection is made.

ssh -p 30000 user@ipaddress

Am I doing something blatantly obvious with the ssh command or is there an error with the iptables script?

All help is very much appreciated!

Answer 1

Check that the IP address that mydomain.com resolves to, is the same IP address that you are actually trying to connect from. I can make the same thing as you see happen, if I create the situation by connecting from a machine with the wrong IP address.

This line in particular

-A INPUT -p tcp --dport 30000 -j DROP

causes the terminal to appear to hang when connecting from the wrong machine. Removing the line and connecting from the wrong machine gives me the error message

ssh: connect to host host.lan port 22: No route to host

Throughout all of this I am able to connect if using a machine that has the correct IP address as resolved by mydomain.com.

Answer 2

I'm terrible with iptables, but what I will say is that running ssh on a non-standard port is basically futile. You can't assume people won't find the port - so you have to build in all the usual protection anyway (restricting access to specific users, or specific client machines, turning off password access and allowing key based access only, etc.)

In which case, the change of port is just more hassle than it's worth.

What I would suggest even if you want to move it to a different port, is get it working on the normal port using the normal config first, and then you can change the port knowing that it used to work, so only the port change can be the cause of any issues.