Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two machines hooked up to a router, one Windows with PuTTY, and one CentOS 6.4 with sshd and with the default SELinux still enabled. They can both ping each other successfully.

I installed the policycore-python package so I could use semanage, then followed these directions.

Step 4 looked like it's the new default, since it was already set up that way.

Step 5 worked and I assume the stuff about ~/.ssh/config is for setting up your ssh client on another machine, so it doesn't apply (I can do something similar in PuTTY.)

Step 6 I figured the shortest and most applicable thing was the third option, so I ran:

iptables -A INPUT -p tcp --dport 2345 --syn -m limit --limit 1/m --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --dport 2345 --syn -j DROP
service iptables save
service iptables restart

At this point, I can do ssh -p 2345 localhost and also ssh -p 2345 on the CentOS box and log into itself fine, but I can no longer PuTTY into the CentOS box. I put the right IP and port 2345 in the connection window, but upon attempting to connect, I get a black screen with a solid green cursor, which, after a few seconds, gives a GUI popup saying Network error: Connection timed out.

If I stop the iptables service, I can log in using PuTTY the same way. So it seems the problem is definitely with iptables and not sshd (nor semanage?).

What's wrong with my iptables?

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:2345 flags:FIN,SYN,RST,ACK/SYN limit: avg 1/min burst 3
DROP       tcp  --  anywhere             anywhere            tcp dpt:2345 flags:FIN,SYN,RST,ACK/SYN

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
share|improve this question
Is sshd really listening that port for the network interface? Try lsof -i :2345, also post your iptables -L rules. – Braiam Jul 4 '13 at 14:56
@Braiam please see question update. – Kev Jul 4 '13 at 15:15
You sure configured putty to use port 2345 and sshd to listen same port when you cleared the iptables? Also verify that your iptables accepts connections to port 2345 – Braiam Jul 4 '13 at 15:38
@Braiam, yes, otherwise I wouldn't be able to log in via PuTTY after service iptables stop, right? And I'm not sure how to verify what you said--I provided iptables -L output in my edit but I'm an iptables n00b. – Kev Jul 4 '13 at 15:42
It's because you are mixing old rules with new rules and the wiki assumes you are configuring iptables from scratch. Flush your tables, use the rules the wiki says and save your table. It should work. – Braiam Jul 5 '13 at 13:13
up vote 1 down vote accepted

The REJECT rule has to come after the new rules. Do this:

$ sudo service iptables stop
[sudo] password for kev:
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Unloading modules:                               [  OK  ]
$ sudo nano /etc/sysconfig/iptables
$ sudo service iptables start

When nano opens, cut the REJECT line and uncut it below the two new rules, then writeout and quit.

Also, you'll need to ssh from localhost just once before you can do it from the outside.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.