iptables - router configuration

Question

I have a router that I am customizing settings for. I want to only allow SSH from the internal network and drop everything else.

This is what I have so far. I tried it and I had to reset my router in order to connect to it again, so I think I am missing something:

iptables -F INPUT
iptables -t filter -A INPUT --match state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT --destination 127.0.0.1 -i lo -j ACCEPT
iptables -t filter -A INPUT -s 192.168.11.0/24 --protocol tcp  --dport $SSH_PORT -j ACCEPT
iptables -t filter -P INPUT DROP

iptables -F FORWARD
iptables -t filter -A FORWARD -s 192.168.11.0/24 --protocol tcp  -j ACCEPT
iptables -t filter -P FORWARD DROP

iptables -F OUTPUT

Is that a good starting point?

Answer 1

Not sure why you have the -P in there.

Here's how I'd do it:

iptables -F INPUT
iptables -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT --destination 127.0.0.1 -i lo -j ACCEPT
iptables -t filter -A INPUT -s 192.168.11.0/24 -m tcp -p tcp --dport $SSH_PORT -j ACCEPT
iptables -t filter -A INPUT -j REJECT --reject-with-icmp-host-prohibited

You don't need to use the forward chain, but if this is a script you should still do the flush of all the chains first.

You can choose to use DROP instead of REJECT in the last line if you want.

Answer 2

After review and having used these rules for over a month, I think it is fairly safe to say the rules work. I use -P to set the policy default. I prefer DROP to REJECT as it uses fewer resources and tells the potential attacker less information.

Walter