Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to apply some iptables rules and iptables -F is supposed to remove the current rules (from my understanding), but instead it appears to freeze my SSH connection and not let me re-establish until I power toggle.

I go through these steps:

1. Apply iptables rules:

# Delete all existing rules
iptables -F

# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# MultiPorts (Allow incoming SSH, HTTP and phpMyAdmin)
iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,2222 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,2222 -m state --state ESTABLISHED -j ACCEPT

# Allow loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow outbound DNS
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

# derp
iptables -A OUTPUT -o eth0 -p tcp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sport 80,443 -m state --state ESTABLISHED -j ACCEPT

# Outgoing Sendmail
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

# DNS server
iptables -A INPUT -p udp -s 0/0 --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -s 0/0 --sport 53 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -d 0/0 --dport 53 -m state --state ESTABLISHED -j ACCEPT

# Allow DNS zone transfer
iptables -A INPUT -p tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

# Prevent DoS attack
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

# Log dropped packets
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
iptables -A LOGGING -j DROP

2. Try to reset with iptables -F

3. Get locked out

What am I doing wrong?

share|improve this question
    
Better approach: Put all your rules in a script stored in a file on the same computer/router where they are implemented, use SSH to execute the script. That way being disconnected by intermediate states doesn't prevent application of the remaining rules, so you can reconnect. Best approach: Have a timer running to restore the prior set of rules if you don't get back in and cancel it. –  Ben Voigt Aug 11 at 18:41

2 Answers 2

up vote 15 down vote accepted

Your policies are on DROP and -F only clears the chains, does not change the policies. iptables -F && iptables -X should do the trick.

share|improve this answer
    
Ah that totally makes sense, thanks. –  Kit Sunde Aug 11 at 12:01

As he said... iptables -F drops it. You never added any new rules in. To just enable ssh it would be:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT service iptables save

That would at least allow ssh access. I recommend you read the following article on easy iptables management... It's for Debian not sure what you're using but it's the same either way.

Like this article I also manage mine via a file /etc/iptables.up.rules that way I can make changes to the file then import them into iptables from there.

http://articles.slicehost.com/2007/9/5/debian-etch-setup-page-1

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.