If you are missing a rule to enable traffic from
ESTABLISHED connections, then you will need a rule allowing traffic from your host to the remote system. It is common to have a first rule like this:
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Then you can enable your access with a rule like:
iptables -A INPUT -s zzz.example.com -p tcp --dport 6789 -j ACCEPT
Alternatively you can use a firewall builder like
shorewall and enable
port knocking to open the port for a few seconds when needed.
If your ssh daemon supports
tcp_wrapers, then you can limit access with the
/etc/hosts.deny files. Even if you have fixed the firewall, you may want to look at using this capability to notify you when remote connections are made. The following rules blocks a number of country domains, and send an email on every succ
sshd : ALL \
EXCEPT .ar .au .br .by .cl .co .cz .do .eg .gt \
.id .il .in .jp .ma .mx .nl .pe .pk .pl .pt \
.ro .rs .ru .sa .sg .tr .tw .ua .vn .za \
.ae .at .bg .gh .hr .hu .ke .kz .lt .md \
.my .no .sk .uy .ve : \
spawn (/bin/echo "SSH connection to %N from %n[%a] allowed" | \
/usr/bin/mailx -s "SSH Allowed" email@example.com)
EDIT: Using domain names in rules is not a good idea:
- DNS lookups may not be available when the rules are loaded. (This is when the name gets converted to an IP address.)
- Clients without static IP addresses may get new addresses, which are not available due DNS caching. Old IP addresses may be left with access, while the new address doesn't have access. Static IP addresses with local host entries work reasonably reliably.
If you have a dynamic address either secure access from a relatively large IP address range, or use port knocking. You can use
fail2ban or a similar program to lock out addresses which are probing your ssh service.
tcpwrappers can be used as above to put restrictions on which addresses can connect, and add additional logging. If you don't connect often, you may want to log successful as well as unsuccessful attempts.