Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
1

I have a VPS with a hosting company so I remotely access it via SSH. I'm trying to flush all the iptables rules and start from scratch... The problem is that when I type # iptables INPUT DROP (as I wan't to block all incoming and whitelist) then PuTTY drops out and I can't connect.

How can I do this without being booted out by CentOS when I type that command.

Or is there another way to do it.

Thanks

share|improve this question

5 Answers

up vote 2 down vote accepted

You need to make sure that your existing connections stay open when you add that rule.

-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT

Then add your allow list below this, and finally add a drop line to the END of the INPUT chain

-A INPUT -j DROP


A good read/tutorial for you to start with would be: here

share|improve this answer
Thanks for your answer - I read the link you provided and experimented on a VirtulBox instance and it all went well and now I understand everything about iptables and using it like a pro :D Thanks :D – Matt Clarke Mar 23 '12 at 22:11
Not a problem, glad to help. If your question has been answered, please vote the answer that best answered your question :) – JDI Lloyd Mar 24 '12 at 0:42
up vote 2 down vote

If you are working remotely I strongly suggest you use a tool like firehol.

Firehol is an iptables/netfilter front-end. It includes code to verify that you haven't locked yourself out. You use the firehol try command, it will start a new set of rules, and then prompt you to type commit. If you don't commit within 30 seconds it will assume you broke something and revert to the old set of rules.

share|improve this answer
P.S. I am not suggesting that you shouldn't learn iptables as well, but a front end can make life a lot easier. – Zoredache Mar 21 '12 at 19:34
up vote 1 down vote

Iptables works on first match wins so you will have to put your catch all DROP at the end of your list.

Take a look at the /etc/sysconfig/iptables file. On a CentOS system it generally has a basic configuration that allows you to ssh in to the box and little else - it would be a good starting point.

share|improve this answer
up vote 0 down vote

I do it buy writing a script that whitelists some things and then afterwards drops everything. So first make your whitelist rules and then append the drop statement to the end of the chain.

share|improve this answer
up vote 0 down vote

Write a 'cron' script and add the rules for iptables to allow you access and set it to run it 5/10 min after you flush your command. That way, you will again re-gain access after 5 minutes.

share|improve this answer
What could possibly go wrong?! – Chopper3 Mar 21 '12 at 19:31
Vote up . CSF works in the same way and its a tried and tested means during testing (assuming no remote KVM). – sonassi Mar 21 '12 at 23:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.