Bryan Christ schrieb: > I locked myself out of my server until I rebooted it. My goal was to > lock down everything and allow only SSH connectivity. Can anyone show > me where my logic went wrong? Here was the fatal script which I wrote: > > /sbin/iptables -F INPUT > /sbin/iptables -A INPUT -s 0/0 -j DROP > /sbin/iptables -A INPUT -s 0/0 -m state --state NEW,ESTABLISHED -p tcp > --dport 22 -j ACCEPT > > My guess is that I missed accepting syn packets, but I'm not ready to > "try" again. No, you didn't miss that. It is in NEW, but this also means, if the first packet of a connection has only ACK set it will also be in state NEW. Your problem is the second rule, which droppes all packets in INPUT, so no SSH packet will ever make it to your ACCEPT rule. Simply delete the second line and set a policy of DROP|REJECT for INPUT. BTW, you can omitt "-s 0/0" - it is default. If I were you, I would do it this way: iptables -P INPUT DROP iptables -A INPUT -p tcp --state ESTABLISHD -j ACCEPT iptables -A INPUT -p tcp --dport 22 --syn -j ACCEPT [Other useful rules] iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset Have a nice time, Joerg
