1

I try to connect to a remote host over ssh (139.162.206.137) but iptables block the connection. This is my actual iptables configuration

[root@SRV1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere             match-set IPs_countries src
DROP       all  --  anywhere             anywhere             match-set IPs_blacklist src
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  81.51.151.22.dyn.user.ono.com  anywhere             tcp dpt:6556
ACCEPT     tcp  --  81.51.151.22.dyn.user.ono.com  anywhere             tcp dpt:12800
ACCEPT     tcp  --  81.51.151.22.dyn.user.ono.com  anywhere             tcp dpt:12801
ACCEPT     icmp --  81.51.151.22.dyn.user.ono.com  anywhere             icmp echo-request
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

There aren't any block policy If I stop iptables service I can connect correctly. What exactly happend with my outbound connection?

Thanks in advance

2 Answers 2

1

The firewall is not blocking the outbound connection (The OUTPUT table has no rules, and has a default allow).

The problem is likely that the return packets from the server are being dropped - ie it is a problem with the INPUT table.

My guess is that one of the first 2 rules are preventing the ssh connection from working. They should come AFTER the "state RELATED,ESTABLISHED" rule, so you should re-order your rules with those blocks at the end.

An alternative would be a specific exception for the machine you are trying to SSH into, like

 iptables -I INPUT -p tcp -s X.X.X.X -j ACCEPT

to accept any traffic from that host or

 iptables -I INPUT -p tcp -s X.X.X.X -p tcp --sport 22 -j ACCEPT

To limit it to SSH traffic from that IP.

0

You should add a rule to allow packet from ssh remote server to your local machine.

sudo iptables -A  INPUT  -p tcp --sport 22  -j ACCEPT

If it doesn't work after adding rule. You can try to change the position by inserting the rule as the first one

sudo iptables -I  INPUT  -p tcp --sport 22  -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.