June 2003
Intermediate to advanced
336 pages
8h 54m
English
You want to permit incoming SSH access but no other incoming access. Allow local connections to all services, however.
For iptables:
# iptables -F INPUT # iptables -A INPUT -p tcp --dport ssh -j ACCEPT # iptables -A INPUT -i lo -j ACCEPT # iptables -A INPUT -j REJECT
For ipchains:
# ipchains -F input # ipchains -A input -p tcp --dport ssh -j ACCEPT # ipchains -A input -i lo -j ACCEPT # ipchains -A input -j REJECT
A common setup is to permit access to a remote machine only by SSH. If you want this access limited to certain hosts or networks, list them by IP address as follows:
For
iptables
:
# iptables -A INPUT -p tcp -s 128.220.13.4 --dport ssh -j ACCEPT # iptables -A INPUT -p tcp -s 71.54.121.19 --dport ssh -j ACCEPT # iptables -A INPUT -p tcp -s 152.16.91.0/24 --dport ssh -j ACCEPT # iptables -A INPUT -j REJECT
For ipchains:
# ipchains -A input -p tcp -s 128.220.13.4 --dport ssh -j ACCEPT # ipchains -A input -p tcp -s 71.54.121.19 --dport ssh -j ACCEPT # ipchains -A input -p tcp -s 152.16.91.0/24 --dport ssh -j ACCEPT # ipchains -A input -j REJECT
The REJECT rule in the preceding iptables and ipchains examples prevents all other incoming connections. If you want to prevent only SSH connections (from nonapproved hosts), use this REJECT rule instead:
For iptables:
# iptables -A INPUT -p tcp --dport ssh -j REJECT
For ipchains:
# ipchains -A input -p tcp --dport ssh -j REJECT
Alternatively you can use TCP-wrappers. [Recipe 3.9] [Recipe ...