how do i get full ssh block accept my ip adresses

R03L · 04-21-2009, 05:58 AM

the topic sais it all,

how to i block full access on SSH accept a coupleo f ip adresses and save this on IPTables for restoring afther reboot.??

please help me whit thisone thanks.

acid_kewpie · 04-21-2009, 07:08 AM

Your title does not say it all. I'm sure it's a simple language issue, but you mean except, not accept, and within iptables they mean very different things. And you've not said what distro your using or firewall management tool to know how to best achieve this.

Basically within iptables you would probably just want to add something like

iptables -A INPUT -p tcp -s a.b.c.d -dport 22 -m state -state NEW -j ACCEPT

Assuming that the rest of your firewall handles established connections generically and such.

jonaskellens · 04-21-2009, 07:35 AM

Quote:

Originally Posted by acid_kewpie

iptables -A INPUT -p tcp -s a.b.c.d -dport 22 -m state -state NEW -j ACCEPT

How about a range of IP-addresses ? Can this be defined with comma-separated values like :

iptables -A INPUT -p tcp -s a.b.c.d, a.b.c.d, a.b.c.d -dport 22 -m state -state NEW -j ACCEPT

win32sux · 04-21-2009, 08:19 PM

Quote:

Originally Posted by jonaskellens

How about a range of IP-addresses ? Can this be defined with comma-separated values like :

iptables -A INPUT -p tcp -s a.b.c.d, a.b.c.d, a.b.c.d -dport 22 -m state -state NEW -j ACCEPT

You gotta use the iprange match module for that. Example:

Code:

iptables -A INPUT -p TCP -m iprange --src-range a.b.c.d-w.x.y.z \
--dport 22 -m state -state NEW -j ACCEPT

billymayday · 04-21-2009, 08:27 PM

If you aren't wedded to iptables, you may find it simpler to simple add these IPs to sshd_config. Something like

AllowUsers *@123.456.78.90 *@098.765.43.21 *@192.168.0.*

etc.

R03L · 04-22-2009, 09:26 AM

yes and now i need to block / drop every other incoming and outgoing connections,

assuming the inserted ip's will be accepted.

R03L · 04-22-2009, 09:26 AM

thanks in advanced

R03L · 04-22-2009, 05:00 PM

and howto restore this atfher reboot, i try iptables-save but afther reboot it's config is gone

R03L · 04-23-2009, 04:15 AM

it's a debian machine there is no /etc/init.d/iptables
command not found