1

I cannot seem to connect to my VPS even when enabling port 22 on my firewall. I have tried multiple iptables inputs to try and allow SSH to work. This is a debian 9 stretch system with iptables persistent installed. Below is the configuration (command form)

    # Allow all loopback (lo) traffic and reject anything
# to localhost that does not originate from lo.
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow ping and ICMP error returns.
iptables -A INPUT -p icmp -m state --state NEW --icmp-type 8 -j ACCEPT
iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT

# Allow SSH.
iptables -A INPUT -i eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 22 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m state --state ESTABLISHED --sport 22 -j ACCEPT

# Allow UDP traffic on port 1194.
iptables -A INPUT -i eth0 -p udp -m state --state NEW,ESTABLISHED --dport 1194 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m state --state ESTABLISHED --sport 1194 -j ACCEPT

# Allow DNS resolution and limited HTTP/S on eth0.
# Necessary for updating the server and keeping time.
iptables -A INPUT -i eth0 -p udp -m state --state ESTABLISHED --sport 53 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m state --state NEW,ESTABLISHED --dport 53 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 443 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 80 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 443 -j ACCEPT

# Allow traffic on the TUN interface.
iptables -A INPUT -i tuan0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT

# then reject them.
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT
iptables -A OUTPUT -j REJECT

COMMIT
  • skip the --state ... restrictions on the SSH rules, and (not relevant) correct the spelling of tuan0. – Ralph Rönnquist Oct 1 '17 at 7:20
  • @RalphRönnquist Why should that cause any problem? – Hauke Laging Oct 1 '17 at 8:59
  • Add the output of iptables -L INPUT -nv --line-numbers ; iptables -L OUTPUT -nv --line-numbers ; netstat --inet --inet6 -lnp to your question. Can you connect locally i.e. ssh localhost? – Hauke Laging Oct 1 '17 at 11:24
  • 1
    You've included tun0. Have you got OpenVPN running too, and if so what is the contents of your routing table (netstat -rn or ip route) – roaima Oct 1 '17 at 12:25
  • I'm guessing that the rules end up dropping the response packets to the connection attempt. – Ralph Rönnquist Oct 1 '17 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.