Home / server / Questions / 619530
Accepted
Kit Sunde
Asked: 2014-08-12 03:54:47 +0800 CST

iptables -F locks me out of the server until reboot, why?

  • 772

I'm trying to apply some iptables rules and iptables -F is supposed to remove the current rules (from my understanding), but instead it appears to freeze my SSH connection and not let me re-establish until I power toggle.

I go through these steps:

1. Apply iptables rules:

# Delete all existing rules
iptables -F

# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# MultiPorts (Allow incoming SSH, HTTP and phpMyAdmin)
iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,2222 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,2222 -m state --state ESTABLISHED -j ACCEPT

# Allow loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow outbound DNS
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

# derp
iptables -A OUTPUT -o eth0 -p tcp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sport 80,443 -m state --state ESTABLISHED -j ACCEPT

# Outgoing Sendmail
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT

# DNS server
iptables -A INPUT -p udp -s 0/0 --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -s 0/0 --sport 53 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -d 0/0 --dport 53 -m state --state ESTABLISHED -j ACCEPT

# Allow DNS zone transfer
iptables -A INPUT -p tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

# Prevent DoS attack
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

# Log dropped packets
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
iptables -A LOGGING -j DROP

2. Try to reset with iptables -F

3. Get locked out

What am I doing wrong?

iptables

2 Answers

  1. Best Answer

    Your policies are on DROP and -F only clears the chains, does not change the policies. iptables -F && iptables -X should do the trick.

    • 16

  2. As he said... iptables -F drops it. You never added any new rules in. To just enable ssh it would be:

    iptables -A INPUT -p tcp --dport 22 -j ACCEPT service iptables save

    That would at least allow ssh access. I recommend you read the following article on easy iptables management... It's for Debian not sure what you're using but it's the same either way.

    Like this article I also manage mine via a file /etc/iptables.up.rules that way I can make changes to the file then import them into iptables from there.

    http://articles.slicehost.com/2007/9/5/debian-etch-setup-page-1

    • 1