0

I am trying to block telnet on my server but I have failed to do so. I have added following firewall rules in INPUT chain of filter table for the same.

INPUT CHAIN(filter table):
<some other firewall rules>
iptables -A INPUT -p tcp --dport 23 -j DROP
iptables -A INPUT -i eth0.2 -j DROP

based on this thread on Ubuntu forums. But I am seeing, I can still able to open telnet on my server. I have also ready some links for the above problem but I am not getting any help. Please let me know where I am wrong in adding rules.

2

First, you should think in the opposite way: you should configure your server's firewall to block all ports except those of the services you run on the machine. E.g. for a HTTP/HTTPS webserver that must be accessible via SSH, this is the relevant iptables config:

*filter 
:INPUT ACCEPT [0:0] 
:FORWARD ACCEPT [0:0] 
:OUTPUT ACCEPT [0:0] 
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT 
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT 
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT 
-A INPUT -j REJECT --reject-with icmp-host-prohibited 
-A FORWARD -j REJECT --reject-with icmp-host-prohibited 
COMMIT 

Secondly, your machine should not even have a telnet server running. It's an unencrypted and insecure protocol; set up SSH instead.

This is just an extrapolation on my part, but I suspect you might want to block external users from using telnet to probe ports on your machine, e.g.

telnet yourhost 25

to probe if there's a SMTP server running. If this is the case, you can't stop them -- just configure the firewall to block all incoming connections except those on the ports of services running on the server.

  • telnet is an extensible protocole. There exist encryption extensions for telnet. – Stéphane Chazelas Jun 5 '15 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.