I need to work on a Debian 6 server through SSH. The server is firewall-protected and SSH connections are filtered based on the user IP.

Unfortunately I have an ISP provider with dynamic IP - it's changing every day.

I managed to write a simple script that reads an IP stored in a file and adds it to firewall's exception list. But right now every time I connect to server I need to:

  • send my IP to the server
  • login to web console
  • restart firewall

Is there any simpler/more automated way to manage firewall protected SSH connections when I have dynamic IP?


Currently I can think of three ways:

The first is to use knockd - my favorite - (http://www.zeroflux.org/projects/knock/) and configure a port sequence only you remember and let knockd open SSH for the IP address you are referring from. knockd is available in a debian package and a sample configuration (/etc/knockd.conf) can be:

logfile = /var/log/knockd.log

sequence      = 2221,2222,2223
seq_timeout   = 5
tcpflags      = syn
start_command = /usr/sbin/iptables -I INPUT -i enp0s8 -s %IP% -p tcp --dport 22 -j ACCEPT
cmd_timeout   = 15
stop_command  = /usr/sbin/iptables -D INPUT -i enp0s8 -s %IP% -p tcp --dport 22 -j ACCEPT

This way knockd will listen for a sequence on the specified ports (they might even be the same) and will open the port if the sequence is hit within 5 seconds. After 15 seconds the rule is removed again so a succesfull login needs to be started within those 15 seconds.

The second one is based on dynamic DNS combined with refreshing an iptables chain regularly:

iptables -N SSH
iptables -A INPUT -p tcp -m tcp --dport 22 -j SSH

Schedule a cronjob to run the following script, for example, every minute:


iptables -F SSH 
iptables -A SSH -s ddns-entry.com -j ACCEPT

This way the SSH chain is flushed and refilled every interval you have chosen.

Alternatively you can create a (password protected) web page on your Debian 6 host which will allow you to enter an IP address which is saved into /tmp/currip for instance. Schedule a cron job to run every minute - or, even better, use inotify/incron - and check the /tmp/currip file and alter the iptables rule to use the address listed in the file. Since it very depends on the kind of web stack you are using I do not list a sample here.


Simplest answer: use dynamic DNS

There are some free (for private use) options around like noip.com, or dyndns.org

EDIT: You have to create a script (for example) that updates the iptables rules constantly, I forgot to mention that earlier. (Thanks to @Lambert)

EDIT2: I don't use a beautiful solution like that, but you could try out this neat python script.

  • 2
    Dynamic DNS will not work since iptables will resolve the host and uses the IP address within the rules. – Lambert Jul 6 '15 at 13:10
  • @Lambert yeah, but what's the problem with that? I use dyn DNS within multiple iptables-scripts and it works without any errors. You have to update the iptables rules constantly, of course (forgot to mention that...sorry) – Lenniey Jul 6 '15 at 13:35
  • There is no problem with it but just to answer to use dynamic DNS is not a solution and simply does not work. I like your edit, especially the link to the script. – Lambert Jul 6 '15 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.