I am trying to get the port knocking service working on my raspberry pi. I have edited my iptables rules to block incoming traffic, but I can still ssh into the pi from my macbook. I should NOT be able to do this, if I'm understanding the iptables rules correctly.
My pi actually did block ssh momentarily when I tested my iptables configuration. But after I installed knockd and started the service, I can ssh without issue again.... even though that is the opposite of what should happen.
from my pi:
sudo iptables -L Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere tcp dpt:http Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination nano /etc/iptables/rules.v4 # Generated by iptables-save v1.4.21 on Wed May 4 23:53:23 2016 *filter :INPUT DROP [469:58510] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1788:276430] -A INPUT -i lo -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT COMMIT # Completed on Wed May 4 23:53:23 2016
From my macbook, after I closed the session so it wouldn't hit the
ssh email@example.com firstname.lastname@example.org's password: # enter password and it logs me in
Actually, none of my iptables rules are being respected. I've blocked literally everything and still get the prompt to log in to ssh; I even get the bullcrap apache index page from the server when I go to that IP in the browser.
sudo iptables -F sudo iptables -P INPUT DROP sudo iptables -P FORWARD DROP sudo iptables -P OUTPUT DROP sudo iptables -L Chain INPUT (policy DROP) target prot opt source destination Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy DROP) target prot opt source destination
About to kick a baby...