0

I am trying to get the port knocking service working on my raspberry pi. I have edited my iptables rules to block incoming traffic, but I can still ssh into the pi from my macbook. I should NOT be able to do this, if I'm understanding the iptables rules correctly.

My pi actually did block ssh momentarily when I tested my iptables configuration. But after I installed knockd and started the service, I can ssh without issue again.... even though that is the opposite of what should happen.

from my pi:

sudo iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination




nano /etc/iptables/rules.v4
# Generated by iptables-save v1.4.21 on Wed May  4 23:53:23 2016
*filter
:INPUT DROP [469:58510]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1788:276430]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
COMMIT
# Completed on Wed May  4 23:53:23 2016

From my macbook, after I closed the session so it wouldn't hit the ESTABLISHED rule

ssh user@pi.local
user@pi.local's password:
# enter password and it logs me in

EDIT

Actually, none of my iptables rules are being respected. I've blocked literally everything and still get the prompt to log in to ssh; I even get the bullcrap apache index page from the server when I go to that IP in the browser.

sudo iptables -F
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT DROP

sudo iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination

About to kick a baby...

14
  • add the rule from the input chain to the forward chain, and set forward to drop. The traffic maybe going through the forward chain.
    – cybernard
    May 5 '16 at 1:43
  • @cybernard I've updated FORWARD to DROP and the problem persists. I also have pam setup in my ssh config if that matters...
    – smilebomb
    May 5 '16 at 1:49
  • did you also add :-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -p tcp -m tcp --dport 80 -j ACCEPT
    – cybernard
    May 5 '16 at 1:51
  • @cybernard No I didn't, but I can work on iptables accepting traffic after I get it to successfully block traffic.
    – smilebomb
    May 5 '16 at 1:53
  • try -A INPUT -j DROP to see if the policy setting is working. As the last rule.
    – cybernard
    May 5 '16 at 1:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.