3

I have a home laptop running Windows 7 and have just set up an Amazon aws ec2 instance running Ubuntu. The Ubuntu instance has the public IP address 34.195.109.193. I use PuTTY to ssh to the ec2 instance. I have found that setting up the iptables rules, on the Ubuntu instance as follows, prevents me from using ssh to access the Ubuntu ec2 instance.

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -d 34.195.109.193 -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -j DROP

I have set my security group up to allow ssh input and output on port 22. I cannot understand why the sudo iptables -A INPUT -d 34.195.109.193 -p tcp --dport 22 -j ACCEPT

line does not allow me to ssh using PuTTY.

  • How is your OUTPUT table set up? – Julie Pelletier Jan 7 '17 at 22:53
  • I was just using the defaults for OUTPUT. Thanks, – OtagoHarbour Jan 7 '17 at 23:33
  • 1
    -d 34.195.109.193 doesn't make sense. The ec2 instance is not aware of its public IP address. This is by design. See the output of ifconfig. – Michael - sqlbot Jan 8 '17 at 3:48
4

You need to change this line

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

To

sudo iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Because your rule matches only established (syn-ack) and related connections, not new ones (syn)

So complete rule should look like:

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -d 34.195.109.193 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -j DROP

sudo iptables -A OUTPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A OUTPUT -p tcp -j DROP

The last output rule, will allow established connections to your host.

  • 1
    Your complete rules (which I prefer) do not reflect the text above. – xhienne Jan 7 '17 at 23:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.