1 |
On 5/21/13, Neal Murphy <neal.p.murphy@××××××××.edu> wrote: |
2 |
> You still aren't accepting *each* direction. Either accept each direction |
3 |
> with |
4 |
> explicit rules or rewrite the rules so they apply to both directions at |
5 |
> once. |
6 |
> The former is probably easier to understand months later, even though it is |
7 |
> |
8 |
> more verbose. |
9 |
> |
10 |
> Mea culpa. I missed the '--dport'; that should be changed to '--sport' in |
11 |
> one |
12 |
> of the rules. I adjusted the rule below. |
13 |
> |
14 |
> N |
15 |
> |
16 |
> On Tuesday, May 21, 2013 11:07:10 AM you wrote: |
17 |
>> Hello Everyone, |
18 |
>> |
19 |
>> #echo -e " - Accepting SSH Traffic" |
20 |
>> $IPTABLES -A TCP -p tcp -m tcp -s 192.168.2.0/24 -d 192.168.2.5 |
21 |
>> --dport 22 -j ACCEPT |
22 |
>> $IPTABLES -A TCP -p tcp -m tcp -s 0.0.0.0/0 -d 192.168.2.5 --dport 22 -j |
23 |
>> DROP |
24 |
>> |
25 |
>> Everything works fine with the REJECT rules commented out, but when |
26 |
>> included SSH access is blocked out. Not sure why, isn't the sequence |
27 |
>> correct (i.e., the ACCPET entries before the DROP and REJECT)? |
28 |
> |
29 |
> SSH isn't a one-way protocol. I believe you need at least one more rule. |
30 |
> This: |
31 |
> -A TCP -p tcp -m tcp -s 192.168.2.0/24 -d 192.168.2.5 \ |
32 |
> --dport 22 -j ACCEPT |
33 |
> only matches packets in one direction. You need to add: |
34 |
> -A TCP -p tcp -m tcp -s 192.168.2.5 -d 192.168.2.0/24 \ |
35 |
> --sport 22 -j ACCEPT |
36 |
> to accept packets in the other direction. |
37 |
> |
38 |
> |
39 |
|
40 |
|
41 |
That was it!!! Thank you so much. For future searchers to similar problems: |
42 |
|
43 |
|
44 |
#!/bin/bash |
45 |
IPTABLES='/sbin/iptables' |
46 |
|
47 |
#Set interface values |
48 |
INTIF1='eth0' |
49 |
|
50 |
#flush rules and delete chains |
51 |
$IPTABLES -F |
52 |
$IPTABLES -X |
53 |
|
54 |
#echo -e " - Accepting input lo traffic" |
55 |
$IPTABLES -A INPUT -i lo -j ACCEPT |
56 |
|
57 |
#echo -e " - Accepting output lo traffic" |
58 |
$IPTABLES -A OUTPUT -o lo -j ACCEPT |
59 |
|
60 |
#echo -e " - Defined Chains" |
61 |
$IPTABLES -N TCP |
62 |
$IPTABLES -N UDP |
63 |
|
64 |
#echo -e " - Accepting SSH Traffic" |
65 |
$IPTABLES -A TCP -p tcp -m tcp -s 192.168.2.0/24 -d 192.168.2.5 |
66 |
--dport 22 -j ACCEPT |
67 |
$IPTABLES -A TCP -p tcp -m tcp -s 192.168.2.5 --sport 22 -d |
68 |
192.168.2.0/24 -j ACCEPT |
69 |
$IPTABLES -A TCP -p tcp -m tcp -s 0.0.0.0/0 -d 192.168.2.5 --dport 22 -j DROP |
70 |
|
71 |
#echo -e " - Accepting input TCP and UDP traffic to open ports" |
72 |
$IPTABLES -A INPUT -i $INTIF1 -p tcp -j TCP |
73 |
$IPTABLES -A INPUT -i $INTIF1 -p udp -j UDP |
74 |
|
75 |
#echo -e " - Accepting output TCP and UDP traffic to open ports" |
76 |
$IPTABLES -A OUTPUT -o $INTIF1 -p tcp -j TCP |
77 |
$IPTABLES -A OUTPUT -o $INTIF1 -p udp -j UDP |
78 |
|
79 |
#echo -e " - Dropping input TCP and UDP traffic to closed ports" |
80 |
$IPTABLES -A INPUT -i $INTIF1 -p tcp -j REJECT --reject-with tcp-rst |
81 |
$IPTABLES -A INPUT -i $INTIF1 -p udp -j REJECT --reject-with |
82 |
icmp-port-unreachable |
83 |
|
84 |
#echo -e " - Dropping output TCP and UDP traffic to closed ports" |
85 |
$IPTABLES -A OUTPUT -o $INTIF1 -p tcp -j REJECT --reject-with tcp-rst |
86 |
$IPTABLES -A OUTPUT -o $INTIF1 -p udp -j REJECT --reject-with |
87 |
icmp-port-unreachable |
88 |
|
89 |
#echo -e " - Dropping input traffic to remaining protocols sent |
90 |
to closed ports" |
91 |
$IPTABLES -A INPUT -i $INTIF1 -j REJECT --reject-with icmp-proto-unreachable |
92 |
|
93 |
#echo -e " - Dropping output traffic to remaining protocols sent |
94 |
to closed ports" |
95 |
$IPTABLES -A OUTPUT -o $INTIF1 -j REJECT --reject-with icmp-proto-unreachable |
96 |
|
97 |
|
98 |
Kind Regards, |
99 |
|
100 |
Nick. |