I have two machines hooked up to a router, one Windows with PuTTY, and one CentOS 6.4 with sshd and with the default SELinux still enabled. They can both ping each other successfully.
I installed the policycore-python package so I could use semanage
, then followed these directions.
Step 4 looked like it's the new default, since it was already set up that way.
Step 5 worked and I assume the stuff about ~/.ssh/config
is for setting up your ssh client on another machine, so it doesn't apply (I can do something similar in PuTTY.)
Step 6 I figured the shortest and most applicable thing was the third option, so I ran:
iptables -A INPUT -p tcp --dport 2345 --syn -m limit --limit 1/m --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --dport 2345 --syn -j DROP
service iptables save
service iptables restart
At this point, I can do ssh -p 2345 localhost
and also ssh -p 2345 192.168.1.4
on the CentOS box and log into itself fine, but I can no longer PuTTY into the CentOS box. I put the right IP and port 2345 in the connection window, but upon attempting to connect, I get a black screen with a solid green cursor, which, after a few seconds, gives a GUI popup saying Network error: Connection timed out
.
If I stop the iptables service, I can log in using PuTTY the same way. So it seems the problem is definitely with iptables
and not sshd
(nor semanage
?).
What's wrong with my iptables
?
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
ACCEPT tcp -- anywhere anywhere tcp dpt:2345 flags:FIN,SYN,RST,ACK/SYN limit: avg 1/min burst 3
DROP tcp -- anywhere anywhere tcp dpt:2345 flags:FIN,SYN,RST,ACK/SYN
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
lsof -i :2345
, also post youriptables -L
rules.service iptables stop
, right? And I'm not sure how to verify what you said--I providediptables -L
output in my edit but I'm aniptables
n00b.