1

I did a preliminary search and was unable to find an exact / similar question.

I'm configuring a server in our network, in order to give SSH access to a normal user from a third party.

I'm trying to isolate the server from the network using IPTables on the server. My idea is to block outgoing SSH access to other parts of the network. I'm asking whether this is enough, or should I block anything else, or what precautions should I take on the IPTables side only.

The third party won't have root or elevated access. They'll be able to SSH to server from a single static IP only.

Improve this question
0

1 Answer 1

Reset to default
2

Generally, for an instance like this, you would have a demilitarized zone (DMZ) to put this server in. A firewall in front of the DMZ would allow SSH to this server from the specified IP address (you mentioned only allowing one static IP) and then a firewall behind the DMZ (between the DMZ and your local network) would block everything else from this server.

What you block is a matter of what the person using the server needs access to. For example, even if you block SSH using IPTables, all other services would be available (ftp, nfs, smb, dns, dhcp, etc - a listing just to give you an idea), so unless you want them to be able to access everything, then you'd need to block all of that.

Improve this answer
1
  • Thanks for your answer. In normal cases, I'd isolate the server in the DMZ, and use an external firewall to the server, however the server is virtual, the hardware is not the DMZ, also the server needs to access some internal services. I've asked the question because I'm not experienced in "egress filtering". Ingress filtering is easier, but it's becoming clear that I need to filter services which the user might interact directly (FTP, SFTP, SSH, SMB, etc.). Thanks again!
    – bayindirh
    Oct 14, 2018 at 14:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .