Linux Networking Cookbook

3.11. Configuring the Firewall for Remote SSH Administration

Problem

You want to SSH into your firewall to do remote administration. You might want to log in from over the Internet, or you might want to restrict SSH to LAN access only. You also want the option of restricting access to certain specific source IP addresses.

Solution

There are several ways to handle this. SSH has a number of access and authentication controls, so you should configure those first. Then, configure iptables to add another layer of access controls.

To restrict SSH access to LAN hosts only, add this rule:

	$ipt -A INPUT -i $LAN_IFACE -p tcp -s 192.168.1.0/24 --dport 22 --sport \
	1024:65535 -m state --state NEW -j ACCEPT

Of course, you must use your own LAN address and SSH port. To allow SSH logins via the WAN interface, use this rule:

	$ipt -A INPUT -p tcp -i $WAN_IFACE --dport 22 --sport 1024:65535 \
	-m state --state NEW -j ACCEPT

This rule accepts SSH logins on all interfaces:

	$ipt -A INPUT -p tcp --dport 22 --sport 1024:65535 -m state --state NEW -j ACCEPT

Or, you may restrict SSH logins to a specific source IP address:

	$ipt -A INPUT -p tcp -s 12.34.56.78 --dport 22 --sport 1024:65535 \
	 -m state --state NEW -j ACCEPT

If there are additional source IP addresses you wish to allow, each one needs its own separate rule.

Discussion

Let's take a look at what these rules do:

-A INPUT -p tcp ! --syn -m state --state NEW -j DROP

A subtle iptables gotcha is that the NEW state will allow TCP packets through that do not have ...