iptables

intervade · 04-30-2009, 04:23 PM

Ok so I'm really new to iptables but I've looked through my logs and I'm seeing a ton of login attemps on my server that shouldn't be there, they are coming in the masses, so I want to block all incoming traffic on my ssh port(22) EXCEPT ips of 192.168.x.x so here is what I've done.

Code:

iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -p tcp -s 192.168.0.0/16 --dport 22 -j ACCEPT

Now that is NOT working, I cannot access my own server on my local network for some strange reason, and yes the server is on my local network haha. Is there something I'm doing wrong?

ALSO

the list command returns:

Code:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
ACCEPT     tcp  --  192.168.0.0/16       0.0.0.0/0           tcp dpt:22

Thanks,
Dalton

rweaver · 04-30-2009, 04:31 PM

They're backwards. You're dropping everything up front.

Code:

iptables -F
iptables -A INPUT -p tcp -s 192.168.0.0/16 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

Quite honestly, if you're already behind a firewall and not doing port forwarding to this machine... you're effectively doing nothing to increase security. If you're port forwarding 22 to this machine from the firewall, just turn it off.

If this IS the firewall then there are better ways to build these rules.