I have two machines hooked up to a router, one Windows with PuTTY, and one CentOS 6.4 with sshd and with the default SELinux still enabled. They can both ping each other successfully.
I installed the policycore-python package so I could use
semanage, then followed these directions.
Step 4 looked like it's the new default, since it was already set up that way.
Step 5 worked and I assume the stuff about
~/.ssh/config is for setting up your ssh client on another machine, so it doesn't apply (I can do something similar in PuTTY.)
Step 6 I figured the shortest and most applicable thing was the third option, so I ran:
iptables -A INPUT -p tcp --dport 2345 --syn -m limit --limit 1/m --limit-burst 3 -j ACCEPT iptables -A INPUT -p tcp --dport 2345 --syn -j DROP service iptables save service iptables restart
At this point, I can do
ssh -p 2345 localhost and also
ssh -p 2345 192.168.1.4 on the CentOS box and log into itself fine, but I can no longer PuTTY into the CentOS box. I put the right IP and port 2345 in the connection window, but upon attempting to connect, I get a black screen with a solid green cursor, which, after a few seconds, gives a GUI popup saying
Network error: Connection timed out.
If I stop the iptables service, I can log in using PuTTY the same way. So it seems the problem is definitely with
iptables and not
What's wrong with my
$ sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited ACCEPT tcp -- anywhere anywhere tcp dpt:2345 flags:FIN,SYN,RST,ACK/SYN limit: avg 1/min burst 3 DROP tcp -- anywhere anywhere tcp dpt:2345 flags:FIN,SYN,RST,ACK/SYN Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination