I am following tutorials on iptable and want to allow ssh traffic on my non-standard SSH port = YYY. I think this is how you do it, but want to double check so I don't lock myself out of my server. This will add a rule as part of an "input chain" (I'm not sure what that is). The rule will accept ssh traffic on port=YYY (by allowing tcp traffic on port=YYY). Right?

$sudo iptables -A INPUT -p tcp --dport YYY -j ACCEPT
  • Is the ssh server listening that port? – Braiam Mar 14 '14 at 1:33
  • @Braiam yes it is – bernie2436 Mar 14 '14 at 1:35
  • Instead of using iptables, I just modified /etc/ssh/sshd_config, which is much simpler. ==EDIT== hang on, perhaps I don't understand the question. – Sparhawk Mar 14 '14 at 1:40
  • @Sparhawk That does different things. sshd_config is where you tell SSH to listen on a different port. You also need to tell your firewall not to block that port, which is what this question is about – Gilles Mar 14 '14 at 1:43
  • @Gilles Ah okay, thanks. I use ufw anyway. – Sparhawk Mar 14 '14 at 2:22

This rule in itself won't lock you out since it only causes some traffic to be accepted.

It is the right rule to allow traffic to port YYY. Make sure that there isn't an earlier rule that would block all traffic (rules are processed in order, the first match applies). Run iptables -nvL INPUT to list the input rules. INPUT is the name of the chain (i.e. a list of rules) that is applied to incoming packets.

You'll presumably a REJECT rule coming after this one to reject other incoming traffic. This is where you need to be careful. Set some firewall ports to only accept local network connections? contains an example of a firewall setting that should be suitable (but use at your own risk, I won't go and reset your server if you get locked out).

Make sure that you don't block output from the server; for a simple configuration, just leave output unrestricted.

To avoid getting locked out, a trick is to put a command to reset the firewall to wide open on a timer, e.g.

sleep 300; iptables -I INPUT -j accept

I recommend doing this from inside screen or tmux. If you do that directly from the ssh connection, there's a risk that the command you run will try to output something and fail because its terminal isn't available anymore.

Note that there is no security benefit in putting SSH on a non-standard port: it won't make SSH less prone to attacks. The only advantage is that you'll have fewer scanning attacks, so less flooding of your logs.

  • 1
    I would note that you can verify the rule is matching before blocking by checking to see if the match counter increases (first column of iptables -nvL) – Patrick Mar 14 '14 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.