I'm creating some firewall rules for a VPS using iptables. My shell script looks something like this:
#!/bin/sh # My system IP/set ip address of server SERVER_IP="220.127.116.11" # Flushing all existing rules iptables -F iptables -X # Setting default filter policy iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # Allow SSH on 22 iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT # Default policy DROP iptables -A INPUT -j DROP iptables -A OUTPUT -j DROP
If i run the
iptables -F command after running this script I get locked out of SSH (I can get back in, but I never want the SSH to go down).
I have three questions.
- Am I being locked out by the default filter policies not being removed when I run the
- Will I not get locked out if I do
- Are the default filter policies even necessary if I'm adding the default drop policy at the end of the shell script anyway?