I have been getting 1000s of failed logins per hour over the past few weeks and I'm sure 99% of them are from bots. I have installed fail2ban and I've been blocking some subnets, but i have also decided to change the port i use for SSH. It's only me using the server, so Its a simple change to get rid of a lot of bot requests.

I have made the change and everything is working fine. I want to now block port 22. I have checked firewalld and there was never a rule for port 22, which makes me wonder how it worked in the first place. Something must have been in place to make sure that port 22 requests were not blocked. How do I disable this and completely lock down port 22?

  • 3
    Port 22 is already closed if you changed the port. – Ipor Sircer Jan 12 '17 at 8:51
  • The firewall was allowing ssh requests to port 22 before, there must be a rule somewhere? – Dan Hastings Jan 12 '17 at 8:52
  • Firewall emulates nearly the same when no daemons listening on port 22. When noone listens it's completely unnecessary to emulate that noone listen on it. – Ipor Sircer Jan 12 '17 at 8:58
  • You should change the topic by: How to block requests to port 22? – Ra_ Jan 12 '17 at 9:06

From your earlier question I see you are using CentOS 6. The /etc/sysconfig/iptables file will contain the state of your IPv4 firewall when it is first loaded. This may be different from the running state of your firewall, especially if you have been adding arbitrary rules. You can save the current state of your firewall with the command

service iptables save

which will overwrite /etc/sysconfig/iptables (it may be prudent to make a backup first).

Under normal circumstances you will find a line like this

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 

which allows connections to port 22. Simply delete the line and then save the file. When you are back at the command line run the command

service iptables reload 

This will ensure that the saved firewall state and the running firewall state are the same. This works because the default firewall on CentOS 6 has a blanket REJECT rule at the end of the INPUT chain.

If you do not want to rely on the blanket REJECT then change the line to

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j DROP

save and restart as above.

Note though that what @ipor says is true. If you have moved sshd to a different port then it is effectively closed as nothing is listening.

  • I am using centos6, but I have installed firewalld to handle the firewall. When I dump all rules I only have 5 open ports all of which must stay open. 22 is not one of those ports. I tried to drop it anyway, but it said it doesn't exist. – Dan Hastings Jan 12 '17 at 11:35
  • Then what is the problem you are trying to solve ? – user9517 Jan 12 '17 at 11:40
  • > I have installed firewalld how did you do that. I didn't think firewalld was supported on C6. – user9517 Jan 12 '17 at 11:52
  • its available from one of the main repos i believe. yum install firewalld. I think its just installed by default on centos 7. – Dan Hastings Jan 12 '17 at 12:17
  • It's not in any of the official CentOS repos or EPEL. – user9517 Jan 12 '17 at 12:20

Use below IPtable rules to block the port 22 in firewall level after login as root.

block ssh over eth0 (nic card) from outside to system.

iptables -F

service iptables save

iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP

iptables -A OUTPUT -o eth0 -p tcp --sport 22 -j DROP

service iptables save

So it will keep iptable state for ever. (remember there are lot way to block unwanted request, you can select which one want to use it in your env. as per your requirement since anyone can do the "googling".)

  • On a standard CentOS system the INPUT chain is terminated with a blanket REJECT all rule, there is also a rule that allows traffic on port 22. Your rules will have no effect as tehy will be Added to the end of the chain after the REJECT rule. – user9517 Jan 12 '17 at 10:19
  • Regarding the update: Why are you destroying the complete firewall state ? – user9517 Jan 12 '17 at 10:54
  • read and understand the requirement fully, dont provide a generic reply – Manoj K Jan 12 '17 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.