LinuxQuestions.org - Use SSH must stop the iptables.

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - Use SSH must stop the iptables. (https://www.linuxquestions.org/questions/linux-newbie-8/use-ssh-must-stop-the-iptables-543712/)

Use SSH must stop the iptables.

Dear all:

I want to SSH an RH(kernel-2.4.20-8). I can access it if iptables is stop.
Otherwise, I can't access it.

The "/etc/sysconfig/iptables" as below:
#ll configuration written by lokkit
# Manual customization of this file is not recommended.
# Note: ifup-post will punch the current nameservers through the
# firewall; such entries will *not* be listed here.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A FORWARD -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68
-i eth0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68
-i eth1 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT
#-A RH-Lokkit-0-50-INPUT -p tcp --dport 22 -j ACCEPT
#-A RH-Lokkit-0-50-OUTPUT -p tcp --dport 22 -j ACCEPT
COMMIT

If I delete the"#"in the last 2 rows, restart the iptables will fail.

Any help will be appreciated.

Thanks,

Actually you don't have a firewall at all, even when it is running:

Quote:

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

By having your defaults set to ACCEPT, absolutely EVERYTHING not explicitly dropped is being allowed. It should be the other way around. You should drop everything and only allow the traffic you want.

Now with that said, its really not clear which combination of rules is causing the trouble. Certainly allowing port 22 on the INPUT chain is required, but this line:

Quote:

#-A RH-Lokkit-0-50-OUTPUT -p tcp --dport 22 -j ACCEPT

Is likely to be useless. The SSH server is listening on port 22, but you really have no idea what port the SSH client is using. It may very well not be port 22. I'm guessing that all the other stuff your dropping is causing the problem. I'm guessing that since you're dropping all sorts of syn packets, that is preventing SSH from working properly. Believe it or not, syn packets are required for TCP/IP to work, so dropping random port ranges is probably not a good idea.

Thanks, Hangdog42.

This time I modified my "/etc/sysconfig/iptables" like below:

#ll configuration written by lokkit

# Manual customization of this file is not recommended.

# Note: ifup-post will punch the current nameservers through the

# firewall; such entries will *not* be listed here.

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:RH-Lokkit-0-50-INPUT - [0:0]

-A INPUT -j RH-Lokkit-0-50-INPUT

-A FORWARD -j RH-Lokkit-0-50-INPUT

-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68

-i eth0 -j ACCEPT

-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68

-i eth1 -j ACCEPT

-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT

#-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT

#-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT

-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT

-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT

-A RH-Lokkit-0-50-INPUT -p tcp --dport 22 -j ACCEPT

COMMIT

and after I restart iptables, I got following results:
# service iptables restart
Flushing all current rules and user defined chains: [ OK ]
Clearing all current rules and user defined chains: [ OK ]
Applying iptables firewall rules: iptables-restore v1.2.7a: no command specified
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]

I'm not sure what tool you would use to modify your firewall (posting your distro might help) but you're probably looking for a firewall that looks something like this:

Code:

iptables -F INPUT

iptables -F OUTPUT

iptables -F FORWARD



iptables -P INPUT DROP

iptables -P OUTPUT DROP

iptables -P FORWARD DROP



iptables -A INPUT -i lo -j ACCEPT

iptables -A OUTPUT -o lo -j ACCEPT



iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT



iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT



iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

This firewall is oversimplified, but maybe it will help you see where to go. Notice that the table defaults are all set to DROP. Then I've allowed ESTABLISHED and RELATED packets in. That allows returned packets from any process originating on my machine to come back. The OUTPUT chain is pretty wide open.

The port 22 rule should let in SSH traffic (it would be NEW, so it would fail the ESTABLISHED and RELATED input rule) and the existing OUTPUT would let the traffic back out.

I really think that your existing firewall is a mess, and it is likely causing problems. If I were in your shoes, I would ditch it entirely and get one in place that you do understand.

Thanks, man.

Quote:

I really think that your existing firewall is a mess, and it is likely causing problems. If I were in your shoes, I would ditch it entirely and get one in place that you do understand.

Ok, man. I agree with you. Could you please teach how to ditch it out and patch a new one?

Thanks,

I gather that you're using some flavor of Red Hat/Fedora and I believe that their firewall is controlled by some GUI tool. How did you get your existing firewall? It doesn't look like a default set of rules, so the same way you created this one should let you create a better set of rules. Knowing what distro you're actually using might help us point you in the right direction.

I used RH9 and the firewall settings as default.

:-)

Quote:

I used RH9

And you're trying to use this as a server exposed to the Internet???????????

A piece of friendly advice: Ditch this distro NOW if not sooner. RH9 has not had any support for a number of years, and there are many, many, many security holes in it. All you're doing with this box is making some botnet owner very happy because they will have another easy-to-crack machine available.

Seriously, you need a newer distro.

I just use this RH for internal learning purpose. And it's not exposed to the internet!

Anyway, thanks for reminding!:D

Ah, good. As a learning tool, RH9 is probably OK. I'd still give some thought to grabbing a newer distro as RH9 is pretty dated.

If you don't know or can't find the RH9 firewall GUI tool, you could always write your own firewall script and then run that. As long as you run it at the end of the RH9 boot, it should replace the default firewall.