1

We are facing IP abuse issues and want to completely BLOCK ssh and ability to ping our servers running Oracle Linux 6.7 and only allow vnc connections. How to achieve this using linux firewall or iptables?

  • I would avise allowing ssh over VPN and especially vnc. As for ping, if you are disabling only reply and requests, you might as well disable it in the kernel. – Rui F Ribeiro Jul 9 '16 at 10:32
  • ufw, is a front end to iptable, it makes it easier, it also does ip6tables. gufw is a graphical front end for ufw. – ctrl-alt-delor Jul 9 '16 at 11:27
  • To block ssh, why don't you simply uninstall sshd? – Federico Poloni Jul 9 '16 at 14:44
5

As OEL 6 using iptables;

Allow ICMP traffic to leave your server, ie so you can ping out

$ iptables -A OUTPUT -p icmp -o eth0 -j ACCEPT   

Then block IMCP replies:

$ iptables -A INPUT -p icmp --icmp-type echo-reply -j DROP
$ iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

SSH would be the same, assuming SSH is on port 22.

$ iptables -A INPUT -p tcp --dport 22 -j DROP

but you could allow SSH from a single IP, or range;

$ iptables -I INPUT -p tcp -s 1.2.3.4 --dport 22 -j ACCEPT

(Note the use of -I to insert the rule at the start of the ACCEPT chain instead of using -A which would place it after the DROP rule and negate its effect.)

  • Thanks that worked perfectly and blocked all ssh connections, but the IPs I am trying to allow are not working. Allowed IPs only in same subnet are able to ssh connect. – Girish Sunkara Jul 9 '16 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.