0

I want to allow only SSH access, FTP access and all communications between my Dedicated Server and all Cloudflare Servers using IPTables. I tried the commands beneath but it seems like I kicked out myself and I don't know what I have done wrong:

# Allow FTP and SSH for our staff 
iptables -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -j ACCEPT 
iptables -A INPUT -p tcp --dport 21 -j ACCEPT 
iptables -A OUTPUT -p tcp --dport 21 -j ACCEPT 
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT

# Allow all Cloudflare IPv4 and IPv6
for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -A INPUT -p tcp --source $i --dport 80 -j ACCEPT; done 
for i in `curl https://www.cloudflare.com/ips-v6`; do ip6tables -A INPUT -p tcp --source $i --dport 443 -j ACCEPT; done

# make sure nothing comes or goes out of this box 
iptables -A INPUT -j DROP 
iptables -A OUTPUT -j DROP 
ip6tables -A INPUT -j DROP

iptables-save > /etc/sysconfig/iptables 
ip6tables-save > /etc/sysconfig/ip6tables

apt-get install iptables-persistent 
service iptables-persistent start 
service iptables-persistent save

After executing this row I got kicked by SSH: iptables -A OUTPUT -j DROP . Also FTP has not worked anymore. What is wrong there??

3
  • Do a packet capture with some SSH traffic to your server. Examine what ports are used for traffic from the server back to the client and I think your mistake will be clear.
    – EEAA
    May 4, 2015 at 20:52
  • It's a fresh installed server which should use the standard ssh port 22 (which I also use when i connect via putty). Further this wouldn't help because i know ftp is using port 21.. I think there is sth else wrong, like the block rules have a higher priority?? May 4, 2015 at 20:53
  • I don't have an Debian or Ubuntu box at hand but the installation of another iptables package as a last step rather than a first might have overwritten your custom rules.
    – HBruijn
    May 4, 2015 at 20:55

1 Answer 1

0

The issue is with the iptables -A OUTPUT -j DROP and how ports are used. Thou you have allowed port 20, 21, and 22. You will never use these ports as your outgoing port. They will be a random number high up in the port range.

Try adding someting like

sudo iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

before your iptables -A OUTPUT -j DROP. This should allow connections that are related to allowed incomming connections to be able to go back out.

4
  • And what do you suggest otherwise to allow only SSH and FTP next to my Cloudflare servers then ? Not sure whether I got you completely. I shall do iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT INSTEAD of my drop command or just BEFORE my drop command? May 4, 2015 at 21:02
  • Just Before your drop command. That should allow for all allowed incoming to travel back out. For all connections. Including your cloudfare.
    – grag42
    May 4, 2015 at 21:46
  • Ok and what do I have to change with my outgoing ports - you said I have used the ports wrong. What commands should I use otherwise? I have to block absolutely everything except SSH, FTP and Cloudflare because I got an IP leak due to an exploit in my Forum Software (uploading remote image). May 4, 2015 at 22:00
  • Those output port are not needed if you are wanting to stop all other traffic. they allow the server to connect to ssh/ftp on another system. You should be able to remove all of those output ports. You should only need the established/related one i sent and then a block all. Or you can set for only the known incoming with iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT adding for the needed ports
    – grag42
    May 4, 2015 at 22:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .