Ok...back with a little question and problem I am having.

I am trying to setup IPTables on remote box. (Mind you, im still learning iPTables, so bare with me).

Now, i want to set default DROPS for INCOMING, OUTGOING and FORWARD. However, when ssh'd in, I can't specify or my connection will get dropped.

My question is, how can I go about doing that? I tried to setup a incoming rule that would allow port 22 access from my IP address, then set the default DROPS, but my connection was severed...

Is there some way I can go about doing this without locking myself out? If I lock myself out, I can't get to the box until late this evening.

Any suggestions?

I appreciate it.

Tarballed

Could you post what you currently are using for firewall rules? Also does the remote system have a dynamic IP address?

Currently don't have any rules for IPTables. Just blank. The box has a static IP address as well.

What I had done before for my first ruels;

iptables -A INPUT -s 192.168.1.90 -m state --state NEW -m tcp -p tcp --syn --dport 22 -j ACCEPT

Then, I tried:

iptables -P INPUT DROP

Cut my connection.

Tarballed

Makes sense. The rule you added:

iptables -A INPUT -s 192.168.1.90 -m state --state NEW -m tcp -p tcp --syn --dport 22 -j ACCEPT

only allows packets that have the syn flag set and are in the NEW state (ie the very first packet) every packet after that in the ssh connection is in the ESTABLISHED state. So either remove the -m state --state NEW and --syn part or just add a rule to allow all packets that are ESTABLISHED or RELATED (probably better idea):

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Ok...so I could do this:

iptables -A INPUT -s 192.168.1.90 -m state --state ESTABLISHED,RELATED -j ACCEPT

then

iptables -P INPUT DROP

Alll should work?

probably what you want is
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -j ACCEPT

That way when you disconnect and try to reconnect it will let you reconnect or it will just drop all new in coming connections.

Ok...so I could do this:
iptables -A INPUT -s 192.168.1.90 -m state --state ESTABLISHED,RELATED -j ACCEPT

You'd still need the first rule:
iptables -A INPUT -s 192.168.1.90 -m state --state NEW -m tcp -p tcp --syn --dport 22 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -P DROP

The ESTABLISHED,RELATED rule will also allow replies to any traffic that you initiate, for example if you ping a remote system then you'll be able to receive the icmp replies or other traffic like DNS replies. Without that rule, then you would need to specify each type of traffic to allow. If you only want to allow ssh traffic (and absolutely no other traffic) then use the rule zatriz posted.

Right...ok...figured out my error after I did more testing.

I ended up doing this:

iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Thanks for the help.

Feel like im finally getting my head wrapped around it. Not to bad, but once you get the basics, I can see it not being too difficult.

thanks,

Tarballed