Bryan Christ wrote:
I locked myself out of my server until I rebooted it. My goal was to
BTDT :)
lock down everything and allow only SSH connectivity. Can anyone show
me where my logic went wrong? Here was the fatal script which I wrote:
/sbin/iptables -F INPUT
/sbin/iptables -A INPUT -s 0/0 -j DROP
/sbin/iptables -A INPUT -s 0/0 -m state --state NEW,ESTABLISHED -p tcp
--dport 22 -j ACCEPT
Rules are evaluated in order. Everything matches your first rule.
Nothing reaches the second one.
My guess is that I missed accepting syn packets, but I'm not ready to
"try" again.
iptables -F INPUT
iptables -P INPUT DROP
# Let in replies to the connections you initiate
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT # allow loopback
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# Everything else falls on the default policy.
Strictly speaking the loopback line is not needed; it just means that
the system will be able to talk to itself. Similarly the --state line is
extra; it just means that when you ssh in you can have useful network
connectivity. I put that one in its own chain ...
iptables -F ; iptables -X
iptables -N State
iptables -A State -m state --state INVALID -j DROP
iptables -A State -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I INPUT -j State
iptables -I FORWARD -j State
See, that's the first rule in both INPUT and FORWARD. Order is
important! That's why we have -A|--append and -I|--insert.
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
