2

We’re setting up a firewall for a machine that should allow:

  • incoming SSH connections from particular IP addresses;
  • ICMP, except for redirect.

We’ve opted to use REJECT over DROP, at least until we’ve finished our current testing.

*filter

# Allow all loopback (lo0) traffic and reject traffic to localhost that does not originate from lo0.
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT

# Reject ICMP redirect.
-A INPUT -p icmp --icmp-type 5 -j REJECT

# Allow ICMP (the types which are not rejected).
-A INPUT -p icmp -j ACCEPT

# Allow SSH connections from specific address
-A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT

# Allow inbound traffic from established connections, including ICMP error returns.
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log what was incoming but denied (optional but useful).
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables_INPUT_denied: " --log-level 7

# Reject all other inbound.
-A INPUT -j REJECT

# Log any traffic which was sent to you for forwarding (optional but useful).
-A FORWARD -m limit --limit 5/min -j LOG --log-prefix "iptables_FORWARD_denied: " --log-level 7

# Reject all traffic forwarding.
-A FORWARD -j REJECT

COMMIT

The machine is behind a NAT router, and port 22 is forwarded to it.

When attempting to connect from an unauthorised IP address, the connection to the host times out after a minute or so.

ssh: connect to host x.x.x.x port 22: Connection timed out

Is this expected? I was thinking the REJECT would result in fairly immediate connection failure. Could it be because the REJECT ICMP packet does not make it back to the connecting machine?

4
  • Or the SSH packet doesn't get there in the first place. Have you tried SSH without the firewall blocking it to make sure NAT and the SSH server is working? Commented May 20, 2016 at 13:33
  • Yes, when the connecting machine's IP address is allowed, the SSH connection is successfully established. Commented May 20, 2016 at 13:44
  • 1
    You should try tcpdump on your SSH server to see whether a packet arrives through the firewall, and whether an ICMP message is sent back to the firewall.
    – To마SE
    Commented May 23, 2016 at 8:48
  • You could try -j REJECT --reject-with tcp-reset to check if it's ICMP packet's fault. Commented May 24, 2016 at 16:02

0

You must log in to answer this question.

Browse other questions tagged .