RE: Verify rules

["Scott Miller" <srmiller@interbel.net>]

That was it - works perfectly.  Now I have a base-line and can start
tweeking and logging from there.  I will do as others have suggested, and
either only allow SSH from one IP address or range, OR use the pubkey
suggestion.

Thanks!
Scott Miller

-----Original Message-----
From: netfilter-owner@vger.kernel.org
[mailto:netfilter-owner@vger.kernel.org] On Behalf Of Mike Wright
Sent: Friday, March 27, 2009 1:55 PM
To: Scott Miller
Cc: netfilter@vger.kernel.org
Subject: Re: Verify rules

Mike Wright wrote:
 > Scott Miller wrote:
 >> Thanks for the suggestions
 >
 > *filter
 > :INPUT DROP [0:0]
 > :FORWARD ACCEPT [0:0]
 > :OUTPUT ACCEPT [0:0]
 > -A INPUT -m state --state ESTABLISHED,RELATED
                                                  ^^^^^^^^
Sorry, it's been a long week.  The above line should read:

 > -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

 > -A INPUT -i lo -j ACCEPT
 > -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
 > -A INPUT -p tcp -m multiport --dports 22,25,53,80,110,873,993,10000 -m
 > state --state NEW -j ACCEPT
 > -A INPUT -p udp -m multiport --dports 53,123,873 -m state --state NEW -j
 > ACCEPT
 > -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset
 > COMMIT


--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
No virus found in this incoming message.
Checked by AVG - www.avg.com 
Version: 8.0.238 / Virus Database: 270.11.28/2022 - Release Date: 03/27/09
07:13:00