Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up IPTables on a new CentOS server. This server will function as an FTP server that I need to be accessible from the outside, however, I want to lock down SSH to only accept internal IP connections.

I need to allow SSH for and Below I've posted my /etc/sysconfig/iptables file. Whenever I apply this, I essentially lock myself out and I have to access it via console using Vsphere. Can somebody show me what I'm doing wrong?

I'm connecting from my laptop with an IP of

:OUTPUT ACCEPT [115:15604]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT 
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -s -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -s -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
share|improve this question - Extra chars since IP wasn't enough >.> –  Corey Whitaker Aug 27 '12 at 21:34
Are you sure about that? Put a LOG rule in to see exactly what's getting rejected. –  Michael Hampton Aug 27 '12 at 21:37
I'm positive that's my internal IP but the log is showing my external IP address even though I'm SSH'ing to the internal IP. Is this normal behavior or do we have some wonky routing rules? –  Corey Whitaker Aug 27 '12 at 21:44
Ahh, NAT strikes again. Can I interest you in some shiny new IPv6? :) Anyway, if your connection is passing outside before coming right back in, then you either aren't on the same network as the server, you're not going through your VPN, or something else is weird with your routing. –  Michael Hampton Aug 27 '12 at 21:47
Trust, I can't wait for IPv6. It's likely that it's going out before coming back in. We've got some weird NAT rules here. Thanks for your help! I'll pass this info off to our network engineer and wee what he thinks. –  Corey Whitaker Aug 27 '12 at 21:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.