Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a little remote server that I can access only with SSH, and what I want to do, is block all the traffic except port 22 for SSH.

The first time, what I did was :

iptables -P INPUT DROP

And of course, it locked me up because I didn't let any input traffic, so I couldn't add the following rules to accept SSH traffic.

How can I block all the traffic (except SSH) and in the same time letting me have access to the server through SSH?

share|improve this question
up vote 3 down vote accepted

You should first set this rule:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

It will authorize already open connection to continue then accept ssh connection (here by ethernet port)

iptables -A INPUT -p tcp -i eth0 --dport ssh -j ACCEPT

Finally you can drop every connections

iptables -P INPUT DROP


You should also allow the loopback to do anything

iptables -I INPUT 2 -i lo -j ACCEPT 
share|improve this answer
Ok ! Thanks for your answer, I'll try out, it would to the trick :) – Rawkins Apr 11 '14 at 9:40
Hum, if I understand well, iptables read rules from top to bottom. If I add : iptables -A INPUT -p tcp -i eth0 --dport ssh -j ACCEPT before iptables -P INPUT DROP will iptables drop all coming traffic at the end ? – Rawkins Apr 11 '14 at 15:25
No because you have a difference between rules and policy. Policy are general behaviour the last applyed and rules are apply in order – Kiwy Apr 11 '14 at 15:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.