Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just trying to make a simple script that will configure iptables to block all incoming and outgoing traffic except for ssh on default port 22 and udp on port 8888.

This is what i have:

# Flush all current rules from iptables
iptables -F

# Set default policies for INPUT, FORWARD and OUTPUT chains
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow SSH connections on tcp port 22
iptables -A INPUT -i eto0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eto0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# Set access for localhost
iptables -A INPUT -i lo -j ACCEPT

# Accept connections on 8888 for vpn access from client
iptables -A INPUT -i eth0 -p udp --dport 8888 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 8888 -m state --state ESTABLISHED -j ACCEPT

# Apply forwarding for OpenVPN Tunneling
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -j ACCEPT     
iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE   
iptables -A FORWARD -j REJECT

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# List rules
iptables -L -v

But when i run it i get locked out of my vps and have to restart it in order to get back in. I really can't see where i am going wrong... also the vpn won't work after running this firewall.

I also wanted to block all pings to the public ip on all ports but have no idea how.

share|improve this question
up vote 4 down vote accepted

for you being locked out on the reason is "eto0!=eth0" , and configure the policies in the end after you have configured all of your rules and you have allowed all outgoing traffic on all interfaces.

for ping related rules do man iptables and read on icmp

Also, in future create a allow all rule something like

/sbin/iptables -P INPUT ALLOW and the same for OUTPUT and FORWARD and put it on your cron to run every 5/10 minutes that way you would get to login even if something goes out of hands.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.