Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a remote system that I SSH. Since I am planning to make this system more publicly accessible, I want to improve my iptables rules over the current policy of accepting anything.

I have added a "iptables -A INPUT -p tcp --dport 22 -j ACCEPT" rule, however I don't really want to change the default rule in a manner that I may lock myself out of the system (and one which would cost me a day and a train fare to resolve right now).

Is there some way I can make changes to iptables (like changing the default rule to DROP) with say a 5 minute timeout, so if I do get a change wrong and lock everyone out, I can just wait a while and try again?

share|improve this question
    
You could put in a rule to accept all traffic from your public IP address, and then make changes after that rule. If you lock other people out and least you can ssh in and change it. Yes there are ways to do time outs. Have to look it up. –  cybernard Jan 13 at 14:30
    
You can also use the at command to execute a script that will remove your rule after a period of time. This way even if your public ip changes, you could still log back in. –  Boogy Jan 13 at 14:34
    
Use a iptables front end that has this feature. For example Firehol has the firehol try fuction. –  Zoredache Jan 13 at 18:31

3 Answers 3

You should have, among other iptables rules, one that states:

 sudo iptables -L
 Chain INPUT (policy ACCEPT)
 target     prot opt source               destination
 ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

If you don't, you can set it up as follows:

  sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

or, if this does not work,

  sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

This way, the session from which you are modifying the iptables will certainly not be affected.

Now you can start modifying iptables as you like and, when you wish to try a new rule, just start from your client pc a distinct ssh session. The ESTABLISHED,RELATED rule does not apply to this new session, so you can see live whether your new sets of rules has cut you off, without any risk.

share|improve this answer
    
@Will Newbery You will have these rules above the rules I suggested below. –  cybernard Jan 16 at 5:13

If you use ipset it can all be automated

 ipset create test hash:ip timeout 300

 iptables -A INPUT -p tcp -m tcp -m multiport -m state --state NEW -j SET --add-set test src ! --dports 25,80,993,5900
 iptables -A input_ext -m set -j DROP  --match-set test src

Change the ports option to whatever you want.

Need to save the list between reboots?

   ipset save >backup.txt

Need tor restore?

   ipset restore <backup.txt

Do you want packet bytes counters?

add the keyword counters to the end of the ipset create statement.

share|improve this answer

Most linux distributions come with the iptables-apply script either already installed or available through the package manager. It will allow you to apply a new set of iptables rules, and rollback automatically if you do not confirm that they work within a certain time.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.