Re: Setting up a local firewall

["Jörg Harmuth" <harmuth@mnemon.de>]

Bryan Christ schrieb:
> I locked myself out of  my server until I rebooted it.  My goal was to
> lock down everything and allow only SSH connectivity.  Can anyone show
> me where my logic went wrong?  Here was the fatal script which I wrote:
> 
> /sbin/iptables -F INPUT
> /sbin/iptables -A INPUT -s 0/0 -j DROP
> /sbin/iptables -A INPUT -s 0/0 -m state  --state NEW,ESTABLISHED -p tcp
> --dport 22 -j ACCEPT
> 
> My guess is that I missed accepting syn packets, but I'm not ready to
> "try" again.

No, you didn't miss that. It is in NEW, but this also means, if the
first packet of a connection has only ACK set it will also be in state
NEW. Your problem is the second rule, which droppes all packets in
INPUT, so no SSH packet will ever make it to your ACCEPT rule. Simply
delete the second line and set a policy of DROP|REJECT for INPUT.

BTW, you can omitt "-s 0/0" - it is default. If I were you, I would do
it this way:

iptables -P INPUT DROP
iptables -A INPUT -p tcp --state ESTABLISHD -j ACCEPT
iptables -A INPUT -p tcp --dport 22 --syn -j ACCEPT
[Other useful rules]
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset

Have a nice time,

Joerg