1

I ran the following iptables commands to allow incoming SSH and ICMP connections and block all others.

sudo iptables -F INPUT
sudo iptables --policy INPUT ACCEPT && sudo iptables --policy OUTPUT 
ACCEPT && sudo iptables --policy FORWARD ACCEPT
sudo iptables -I INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -I INPUT -p icmp -j ACCEPT
sudo iptables -I OUTPUT -p tcp --sport 5051  -j REJECT
sudo iptables -A INPUT -j REJECT

The resulting iptables listing looks like this

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     tcp  --  anywhere             anywhere             match-set minuteman dst,dst tcp flags:FIN,SYN,RST,ACK/SYN reject-with icmp-port-unreachable
DOCKER-ISOLATION  all  --  anywhere             anywhere            
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     tcp  --  anywhere             anywhere             tcp spt:ita-agent reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             match-set minuteman dst,dst tcp flags:FIN,SYN,RST,ACK/SYN reject-with icmp-port-unreachable

Chain DOCKER (1 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

I see that line accepting SSH comes before the one that rejects all other traffic. But I am still not able to SSH into the machine.

Any clues why this is not working?

  • What about accepting ssh OUTPUT? – jiipeezz Aug 11 '17 at 8:41
  • I don't need to accept SSH output – Akhil Raina Aug 11 '17 at 9:12
  • Yes, you need to accept output SSH traffic -- ( iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT ) – Vafa Aug 11 '17 at 9:25
  • Actually, it works fine as long as I don't run the last rule: sudo iptables -A INPUT -j REJECT – Akhil Raina Aug 11 '17 at 10:27
0

If you only need to allow SSH and ICMP

# Flush the FW Rules 
iptables -F
iptables  -X

# Block all traffic
iptables  -P INPUT DROP
iptables  -P FORWARD DROP
iptables  -P OUTPUT DROP


# Allow SSH
iptables  -A OUTPUT -p tcp --dport 22 -j ACCEPT 
iptables  -A INPUT -p tcp --dport 22 -j ACCEPT


# Allow ICMP (ping)
iptables  -A INPUT -p icmp -j ACCEPT
iptables  -A OUTPUT -p icmp -j ACCEPT
  • Shouldn't the allow statements be above the block statements – Akhil Raina Aug 16 '17 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.