0

I want to SSH to 192.168.1.15 server from my machine, my ip was 192.168.1.99.

Source destination was UP, with IP 192.168.1.15.

This is a LAN, there are 30 machines connected to the network and working fine, I'm playing around the local machines cos i need to apply the same rules in production VPS.

I have applied the below iptables in my machine 192.168.1.99. Now i can't receive any packets from outside and i can't send any packets outside, while applying the below chain

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

After the above CHAIN i have added the below rules and it want to allow ssh from machine to 192.168.1.15 to access the 192.164.1.15 but still i can't access 192.168.1.15.

iptables -A INPUT -p tcp -i eth0 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -o eth0 --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

Any one please check whether my rules are right. Still i can't access the machine 15.

1

Your rules look correct but cover both serving ssh and using the ssh client.

The interface doesn't have to be specified unless you need to be that granular.

ICMP messages are being blocked which may be stopping the connection from working.

Loopback traffic is also being dropped which may have some unintended consequences.

  • Client rules

    iptables -A INPUT  -i lo   -j ACCEPT
    iptables -A OUTPUT -o lo   -j ACCEPT
    iptables -A INPUT  -p icmp -j ACCEPT
    iptables -A OUTPUT -p icmp -j ACCEPT
    iptables -A INPUT  -p tcp  --sport 22 -m state --state ESTABLISHED     -j ACCEPT
    iptables -A OUTPUT -p tcp  --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
    
  • Server rules

    iptables -A INPUT  -i lo   -j ACCEPT
    iptables -A OUTPUT -o lo   -j ACCEPT
    iptables -A INPUT  -p icmp -j ACCEPT
    iptables -A OUTPUT -p icmp -j ACCEPT
    iptables -A INPUT  -p tcp  --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
    iptables -A OUTPUT -p tcp  --sport 22 -m state --state ESTABLISHED     -j ACCEPT
    

While testing you can monitor what traffic is being generated on the client and appearing on the server by running a tcpdump while attempting the connections. This can help you narrow down where the issue lies or what is happening.

client$ tcpdump -ni eth0 host 192.168.1.15
server$ tcpdump -ni eth0 host 192.168.1.99
  • Your hosts will most likely need access granted to their dns servers as well – Matt Jun 4 '14 at 10:03
  • Thanks for Share, Instead of eth0 i have to replace with br0, cos there is a Bridge, Thanks you. Got a point from your posting to add the localhost :) – Babin Lonston Jun 4 '14 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.