Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a router that I am customizing settings for. I want to only allow SSH from the internal network and drop everything else.

This is what I have so far. I tried it and I had to reset my router in order to connect to it again, so I think I am missing something:

iptables -F INPUT
iptables -t filter -A INPUT --match state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT --destination 127.0.0.1 -i lo -j ACCEPT
iptables -t filter -A INPUT -s 192.168.11.0/24 --protocol tcp  --dport $SSH_PORT -j ACCEPT
iptables -t filter -P INPUT DROP

iptables -F FORWARD
iptables -t filter -A FORWARD -s 192.168.11.0/24 --protocol tcp  -j ACCEPT
iptables -t filter -P FORWARD DROP

iptables -F OUTPUT

Is that a good starting point?

share|improve this question
    
Can you edit your question and post the output iptables-save? – pepoluan Mar 10 '11 at 12:27

Not sure why you have the -P in there.

Here's how I'd do it:

iptables -F INPUT
iptables -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT --destination 127.0.0.1 -i lo -j ACCEPT
iptables -t filter -A INPUT -s 192.168.11.0/24 -m tcp -p tcp --dport $SSH_PORT -j ACCEPT
iptables -t filter -A INPUT -j REJECT --reject-with-icmp-host-prohibited

You don't need to use the forward chain, but if this is a script you should still do the flush of all the chains first.

You can choose to use DROP instead of REJECT in the last line if you want.

share|improve this answer
1  
Why not -P, it sets default chain rule. That's better than adding special rule as last rule. Now if you add additional rules with -A, it'll go after REJECT, and therefore it's useless. That's not the case with -P – Olli Feb 27 '11 at 17:23
    
Fair point. I also use -P on occasion, but the explicit last rule serves me well, and also means iptables returns ICMP unreachable (which helps in my environment, where I have both system-level firewalling and switch ACL firewalls that do not return ICMP unreachable). When I add rules, I use -I <chain> <rule number>, possibly because I'm a masochist. :) – superdupersheep Feb 27 '11 at 18:56
    
I prefer DROP as it uses slightly less resources than reject since no reply is sent. – Walter White Feb 28 '11 at 19:14
    
If this is a router, I need the forward chain right? – Walter White Feb 28 '11 at 21:17
up vote 0 down vote accepted

After review and having used these rules for over a month, I think it is fairly safe to say the rules work. I use -P to set the policy default. I prefer DROP to REJECT as it uses fewer resources and tells the potential attacker less information.

Walter

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .