Welcome to the most active Linux Forum on the web.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 11-11-2010, 11:32 PM   #1
Registered: Mar 2009
Location: Bay Area, CA
Distribution: Redhat Enterprise Linux
Posts: 59

Rep: Reputation: 15
Help with iptables

I am trying to block SSH Access to my server and only allow subnet.

But for some reason, it isn't working quite right. Any machines from can access.

I've already tried "iptables -A C-RULES -s -p tcp --dport 22 -j ACCEPT" which should only accept ssh connections from 192.168.0.* subnet.

Can someone tell me what's wrong with my firewall rules? I'm using RHEL5.5

Here is my /etc/sysconfig/iptables:

[root@ws5 ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.3.5 on Wed Nov 10 23:25:10 2010
:INPUT ACCEPT [100:8477]
:OUTPUT ACCEPT [98:8676]
:C-RULES - [0:0]
-A C-RULES -i lo -j ACCEPT
-A C-RULES -p icmp -j ACCEPT
-A C-RULES -p tcp -m tcp --dport 631 -j ACCEPT
-A C-RULES -p udp -m udp --dport 631 -j ACCEPT
-A C-RULES -p tcp -m tcp --dport 22 -s -j REJECT
-A C-RULES -j REJECT --reject-with icmp-host-prohibited
# Completed on Wed Nov 10 23:25:10 2010
Old 11-12-2010, 12:53 AM   #2
LQ Guru
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
Can you post your currently active configuration? Like this:
iptables -nvL --line-numbers
It seems as if though you aren't sending the packets into the chain you built, in which case the solution would be something like:
iptables -A INPUT -j C-RULES
...but let's see what you've got first.

Last edited by win32sux; 11-12-2010 at 01:02 AM.
Old 11-12-2010, 03:25 AM   #3
Registered: Aug 2007
Location: INDIA
Distribution: CentOS, RHEL, Fedora, Debian, Ubuntu, LinuxMint, Kali Linux, Raspbian
Posts: 166

Rep: Reputation: 10
you forgot to send packet to c-rules table.
Old 11-14-2010, 03:25 PM   #4
Registered: Mar 2009
Location: Bay Area, CA
Distribution: Redhat Enterprise Linux
Posts: 59

Original Poster
Rep: Reputation: 15
Thanks much win32sux and kaushalpatel1982.

My iptables rule is working now.

I normally use the INPUT chain so I never had to send it to a new chain. Since this rule is used on a new subnet, I did not know that we need to send the packets to the new chain.

Last edited by rhel5; 11-14-2010 at 03:26 PM.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
On what basis CHAIN integer values are generated in IPtables under iptables file? haariseshu Linux - Server 3 11-05-2009 04:25 AM
[SOLVED] Rather huge IPtables chain, iptables: Memory allocation problem. Gangrif Linux - Networking 10 09-11-2009 03:30 PM
iptables v1.2.9: Unknown arg `/sbin/iptables' Try `iptables -h' or 'iptables --help' Niceman2005 Linux - Security 4 12-29-2005 08:20 PM
IPtables Log Analyzer from brainlego Linux - Software 0 08-11-2003 06:08 AM
My iptables script is /etc/sysconfig/iptables. How do i make this baby execute on boo ForumKid Linux - General 3 01-22-2002 07:36 AM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 08:10 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration