I have a VPS with a hosting company so I remotely access it via SSH. I'm trying to flush all the iptables rules and start from scratch... The problem is that when I type # iptables INPUT DROP (as I wan't to block all incoming and whitelist) then PuTTY drops out and I can't connect.

How can I do this without being booted out by CentOS when I type that command.

Or is there another way to do it.



You need to make sure that your existing connections stay open when you add that rule.

-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT

Then add your allow list below this, and finally add a drop line to the END of the INPUT chain


A good read/tutorial for you to start with would be: here

  • Thanks for your answer - I read the link you provided and experimented on a VirtulBox instance and it all went well and now I understand everything about iptables and using it like a pro :D Thanks :D – Clarkey Mar 23 '12 at 22:11
  • Not a problem, glad to help. If your question has been answered, please vote the answer that best answered your question :) – LloydOliver Mar 24 '12 at 0:42

Iptables works on first match wins so you will have to put your catch all DROP at the end of your list.

Take a look at the /etc/sysconfig/iptables file. On a CentOS system it generally has a basic configuration that allows you to ssh in to the box and little else - it would be a good starting point.


If you are working remotely I strongly suggest you use a tool like firehol.

Firehol is an iptables/netfilter front-end. It includes code to verify that you haven't locked yourself out. You use the firehol try command, it will start a new set of rules, and then prompt you to type commit. If you don't commit within 30 seconds it will assume you broke something and revert to the old set of rules.

  • P.S. I am not suggesting that you shouldn't learn iptables as well, but a front end can make life a lot easier. – Zoredache Mar 21 '12 at 19:34

I do it buy writing a script that whitelists some things and then afterwards drops everything. So first make your whitelist rules and then append the drop statement to the end of the chain.


Write a 'cron' script and add the rules for iptables to allow you access and set it to run it 5/10 min after you flush your command. That way, you will again re-gain access after 5 minutes.

  • What could possibly go wrong?! – Chopper3 Mar 21 '12 at 19:31
  • Vote up . CSF works in the same way and its a tried and tested means during testing (assuming no remote KVM). – Ben Lessani - Sonassi Mar 21 '12 at 23:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.