Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am following tutorials on iptable and want to allow ssh traffic on my non-standard SSH port = YYY. I think this is how you do it, but want to double check so I don't lock myself out of my server. This will add a rule as part of an "input chain" (I'm not sure what that is). The rule will accept ssh traffic on port=YYY (by allowing tcp traffic on port=YYY). Right?

$sudo iptables -A INPUT -p tcp --dport YYY -j ACCEPT
share|improve this question
    
Is the ssh server listening that port? –  Braiam Mar 14 at 1:33
    
@Braiam yes it is –  akh2103 Mar 14 at 1:35
    
Instead of using iptables, I just modified /etc/ssh/sshd_config, which is much simpler. ==EDIT== hang on, perhaps I don't understand the question. –  Sparhawk Mar 14 at 1:40
    
@Sparhawk That does different things. sshd_config is where you tell SSH to listen on a different port. You also need to tell your firewall not to block that port, which is what this question is about –  Gilles Mar 14 at 1:43
    
@Gilles Ah okay, thanks. I use ufw anyway. –  Sparhawk Mar 14 at 2:22

1 Answer 1

This rule in itself won't lock you out since it only causes some traffic to be accepted.

It is the right rule to allow traffic to port YYY. Make sure that there isn't an earlier rule that would block all traffic (rules are processed in order, the first match applies). Run iptables -nvL INPUT to list the input rules. INPUT is the name of the chain (i.e. a list of rules) that is applied to incoming packets.

You'll presumably a REJECT rule coming after this one to reject other incoming traffic. This is where you need to be careful. Set some firewall ports to only accept local network connections? contains an example of a firewall setting that should be suitable (but use at your own risk, I won't go and reset your server if you get locked out).

Make sure that you don't block output from the server; for a simple configuration, just leave output unrestricted.

To avoid getting locked out, a trick is to put a command to reset the firewall to wide open on a timer, e.g.

sleep 300; iptables -I INPUT -j accept

I recommend doing this from inside screen or tmux. If you do that directly from the ssh connection, there's a risk that the command you run will try to output something and fail because its terminal isn't available anymore.

Note that there is no security benefit in putting SSH on a non-standard port: it won't make SSH less prone to attacks. The only advantage is that you'll have fewer scanning attacks, so less flooding of your logs.

share|improve this answer
1  
I would note that you can verify the rule is matching before blocking by checking to see if the match counter increases (first column of iptables -nvL) –  Patrick Mar 14 at 3:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.