Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a router that I am customizing settings for. I want to only allow SSH from the internal network and drop everything else.

This is what I have so far. I tried it and I had to reset my router in order to connect to it again, so I think I am missing something:

iptables -F INPUT
iptables -t filter -A INPUT --match state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT --destination 127.0.0.1 -i lo -j ACCEPT
iptables -t filter -A INPUT -s 192.168.11.0/24 --protocol tcp  --dport $SSH_PORT -j ACCEPT
iptables -t filter -P INPUT DROP

iptables -F FORWARD
iptables -t filter -A FORWARD -s 192.168.11.0/24 --protocol tcp  -j ACCEPT
iptables -t filter -P FORWARD DROP

iptables -F OUTPUT

Is that a good starting point?

share|improve this question
    
Can you edit your question and post the output iptables-save? –  pepoluan Mar 10 '11 at 12:27
add comment

2 Answers

Not sure why you have the -P in there.

Here's how I'd do it:

iptables -F INPUT
iptables -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT --destination 127.0.0.1 -i lo -j ACCEPT
iptables -t filter -A INPUT -s 192.168.11.0/24 -m tcp -p tcp --dport $SSH_PORT -j ACCEPT
iptables -t filter -A INPUT -j REJECT --reject-with-icmp-host-prohibited

You don't need to use the forward chain, but if this is a script you should still do the flush of all the chains first.

You can choose to use DROP instead of REJECT in the last line if you want.

share|improve this answer
1  
Why not -P, it sets default chain rule. That's better than adding special rule as last rule. Now if you add additional rules with -A, it'll go after REJECT, and therefore it's useless. That's not the case with -P –  Olli Feb 27 '11 at 17:23
    
Fair point. I also use -P on occasion, but the explicit last rule serves me well, and also means iptables returns ICMP unreachable (which helps in my environment, where I have both system-level firewalling and switch ACL firewalls that do not return ICMP unreachable). When I add rules, I use -I <chain> <rule number>, possibly because I'm a masochist. :) –  superdupersheep Feb 27 '11 at 18:56
    
I prefer DROP as it uses slightly less resources than reject since no reply is sent. –  Walter White Feb 28 '11 at 19:14
    
If this is a router, I need the forward chain right? –  Walter White Feb 28 '11 at 21:17
add comment
up vote 0 down vote accepted

After review and having used these rules for over a month, I think it is fairly safe to say the rules work. I use -P to set the policy default. I prefer DROP to REJECT as it uses fewer resources and tells the potential attacker less information.

Walter

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.