I was configuring a server, and I tried instituting what I thought were some pretty simple iptables rules:
[root host ~] - iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere REJECT all -- anywhere loopback/8 reject-with icmp-port-unreachable ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere tcp dpt:www ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh ACCEPT icmp -- anywhere anywhere icmp echo-request Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root host ~] - iptables -P INPUT DROP
Which resulted in the hanging of my SSH session. Now I can't access the machine by SSH at all, but all the other allowances (HTTP etc.) seem to be working fine.
I did a little more research after the fact, but this still looks like a correct configuration to me.
It seems to me that I've misunderstood the stated filtering iptables offers. Is that so? What's wrong with this picture?
EDIT: I adapted my rules from the debian iptables article, so you can see the original input lines there.
DOUBLE EDIT: I should be doing the leg work here; I've recreated the original inputs from the Debian article
-A INPUT -i lo -j ACCEPT -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p tcp --dport 80 -j ACCEPT -A INPUT -p tcp --dport 443 -j ACCEPT -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT