0

I have a wired network with IP 192.168.1.1/24 range and an access point the gives out 192.168.2.1/24 ip´s. I need to block access to ssh server to all except ip´s in 192.168.1.x subnet using iptables.

this is my current rules:

# Generated by iptables-save v1.4.7 on Fri Sep 23 10:01:57 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3:120]
-A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j DROP
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
COMMIT

I aded a rule to accept 192.168.1.x ( dont know if its the correct syntax) and then a drop every other conections to port 22

i notice that when i log in to ssh terminal it shows me that i am logged in from the access point ip and since it is in the subnet allowed i am clueless of how to procede.

Thanks for the help

Improve this question
0

1 Answer 1

Reset to default
0

I understand that you want to allow access to your ssh server only to a certain IP subnet, to achieve that you can update your iptables with this:

-I INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
-A INPUT -p tcp --dport 22 -j REJECT
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .