I have a remote system that I SSH. Since I am planning to make this system more publicly accessible, I want to improve my iptables rules over the current policy of accepting anything.

I have added a "iptables -A INPUT -p tcp --dport 22 -j ACCEPT" rule, however I don't really want to change the default rule in a manner that I may lock myself out of the system (and one which would cost me a day and a train fare to resolve right now).

Is there some way I can make changes to iptables (like changing the default rule to DROP) with say a 5 minute timeout, so if I do get a change wrong and lock everyone out, I can just wait a while and try again?

  • You could put in a rule to accept all traffic from your public IP address, and then make changes after that rule. If you lock other people out and least you can ssh in and change it. Yes there are ways to do time outs. Have to look it up.
    – cybernard
    Jan 13, 2014 at 14:30
  • You can also use the at command to execute a script that will remove your rule after a period of time. This way even if your public ip changes, you could still log back in.
    – Boogy
    Jan 13, 2014 at 14:34
  • Use a iptables front end that has this feature. For example Firehol has the firehol try fuction.
    – Zoredache
    Jan 13, 2014 at 18:31

4 Answers 4


Most linux distributions come with the iptables-apply script either already installed or available through the package manager. It will allow you to apply a new set of iptables rules, and rollback automatically if you do not confirm that they work within a certain time.

  • very clean and simplest; I used to have a script to do that. Much simpler to do iptables-apply -t 60 my-iptables-defs.
    – Pierre D
    Dec 15, 2020 at 14:57

You should have, among other iptables rules, one that states:

 sudo iptables -L
 Chain INPUT (policy ACCEPT)
 target     prot opt source               destination
 ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

If you don't, you can set it up as follows:

  sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

or, if this does not work,

  sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

This way, the session from which you are modifying the iptables will certainly not be affected.

Now you can start modifying iptables as you like and, when you wish to try a new rule, just start from your client pc a distinct ssh session. The ESTABLISHED,RELATED rule does not apply to this new session, so you can see live whether your new sets of rules has cut you off, without any risk.

  • @Will Newbery You will have these rules above the rules I suggested below.
    – cybernard
    Jan 16, 2014 at 5:13

If you use ipset it can all be automated

 ipset create test hash:ip timeout 300

 iptables -A INPUT -p tcp -m tcp -m multiport -m state --state NEW -j SET --add-set test src ! --dports 25,80,993,5900
 iptables -A input_ext -m set -j DROP  --match-set test src

Change the ports option to whatever you want.

Need to save the list between reboots?

   ipset save >backup.txt

Need tor restore?

   ipset restore <backup.txt

Do you want packet bytes counters?

add the keyword counters to the end of the ipset create statement.


Just instal fail2ban and enable ssh and ssd-dos . You can set banned time easily. The other way, install other remote access e.g. Webmin, and run it on non standard port.

add these lines into filter sshd.conf and add these lines at the end of failregex section

vi /etc/fail2ban/filter.d/sshd.conf

.... ^%(__prefix_line)sConnection closed by [preauth]$ ^%(__prefix_line)sReceived disconnect from : 11: (Bye Bye)? [preauth]$ ^%(__prefix_line)sReceived disconnect from : 3: \S+: Auth fail$ ^%(__prefix_line)s(?:error: )?Received disconnect from : 3: .*: Auth fail(?: [preauth])?$


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .