Eial Czerwacki wrote:
what I meant is that I want that ssh input will be accepted only from an ip that I've initiated the connection to.
On Fri 25 Jan 18:13 2008 mouss wrote:
Eial Czerwacki wrote:
works with it and without that, one more question, is there a way to approve a input only if I initiated the connection?
that's what your "accept all previously established connections" does if
you don't add other INPUT rules.
[ Please don't toppost ]
Yes, you need the recent module for this. Add the source of outgoing
connections to a recent table and accept on source address in that table.
Something like this (untested!):
# Don't let established packets trigger the recent match below....
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -o $EXTERNAL_IF -m recent --set --name tcpout --rdest
-A INPUT -i $EXTERNAL_IF -m recent --rcheck --seconds 100 --name tcpout
--rsource -m tcp --dport 22 -j ACCEPT
HTH,
M4
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
