I wanted to add some rules to iptables from this question and answers to route traffic from torrent programm Transmission through a vpn (surfshark in my case).
At least two of the answers use iptables -F to flush the tables before adding the custom rules.
One of these answers specifically references a headless server (like mine). So I suspect this should work.
But if I use iptables -F I instantly get kicked out of my ssh-session to the server. I am unable to type any new command on the terminal and have to reboot the server to log in again.
I have a firewall running on the server that permitts port 22 to every IP.
For clarification I will add some output from before and after I applied the accepted answer:
Before (notice policy DROP):
$ sudo iptables -xvnL
Chain INPUT (policy DROP 21 packets, 5628 bytes)
pkts bytes target prot opt in out source destination
387 31969 f2b-sshd tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 22
27008 50413306 ufw-before-logging-input all -- * * 0.0.0.0/0 0.0.0.0/0
27008 50413306 ufw-before-input all -- * * 0.0.0.0/0 0.0.0.0/0
153 26176 ufw-after-input all -- * * 0.0.0.0/0 0.0.0.0/0
21 5628 ufw-after-logging-input all -- * * 0.0.0.0/0 0.0.0.0/0
21 5628 ufw-reject-input all -- * * 0.0.0.0/0 0.0.0.0/0
21 5628 ufw-track-input all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ufw-before-logging-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-before-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-after-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-after-logging-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-reject-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-track-forward all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 7 packets, 324 bytes)
pkts bytes target prot opt in out source destination
7130 870596 ufw-before-logging-output all -- * * 0.0.0.0/0 0.0.0.0/0
7130 870596 ufw-before-output all -- * * 0.0.0.0/0 0.0.0.0/0
997 113175 ufw-after-output all -- * * 0.0.0.0/0 0.0.0.0/0
997 113175 ufw-after-logging-output all -- * * 0.0.0.0/0 0.0.0.0/0
997 113175 ufw-reject-output all -- * * 0.0.0.0/0 0.0.0.0/0
997 113175 ufw-track-output all -- * * 0.0.0.0/0 0.0.0.0/0
After:
$ sudo iptables -L -v
Chain INPUT (policy ACCEPT 12648 packets, 12M bytes)
This is after I set to policy ACCEPT, then flush, then add the rules for transmission-daemon from the other answer here, then made this setting persisten after reboot with sudo dpkg-reconfigure iptables-persistent, reboot and log into ssh. I now would like to policy DROP but this will kick me out again.
Maybe interesting: I deactivated the ufw firewall just to make sure. After I reactivated it, it also threw me out (while policy ACCEPT). Of course I had a allow 22 rule. I had to reboot and then I could log in again with working firewall.
I lack understanding of iptables and will definitely look into it. I don't know how activating the firewall can throw me out if main policy is ACCEPT and the firewall has an open 22.
$ sudo iptables -xvnL
[sudo] Passwort für ben:
Chain INPUT (policy ACCEPT 34981 packets, 9871660 bytes)
pkts bytes target prot opt in out source destination
121 15110 f2b-sshd tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 22
0 0 ACCEPT all -- tun0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0
134 12445 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 19730 packets, 3108705 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * eth0 0.0.0.0/0 192.168.100.0/25 tcp spt:9091 owner GID match 136
0 0 ACCEPT udp -- * eth0 0.0.0.0/0 192.168.100.0/25 udp spt:9091 owner GID match 136
0 0 ACCEPT all -- * tun0 0.0.0.0/0 0.0.0.0/0 owner GID match 136
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0 owner GID match 136
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 owner GID match 136 reject-with icmp-port-unreachable
Chain f2b-sshd (1 references)
pkts bytes target prot opt in out source destination
121 15110 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain ufw-after-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-after-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-after-logging-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-after-logging-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-after-logging-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-after-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-before-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-before-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-before-logging-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-before-logging-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-before-logging-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-before-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-logging-allow (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-logging-deny (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-not-local (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-reject-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-reject-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-reject-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-skip-to-policy-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-skip-to-policy-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-skip-to-policy-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-track-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-track-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-track-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-user-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-user-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-user-limit (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-user-limit-accept (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-user-logging-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-user-logging-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-user-logging-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw-user-output (0 references)
pkts bytes target prot opt in out source destination
Here the firewall rules:
$ sudo ufw status
Status: Aktiv
Zu Aktion Von
-- ------ ---
22 ALLOW 192.168.100.0/24
5900 ALLOW 192.168.100.0/24 # vnc
1900 ALLOW 192.168.100.0/24 # minidlna
8200 ALLOW 192.168.100.0/24 # minidlna
445 ALLOW 192.168.100.0/24 # cifs
5901 ALLOW 192.168.100.0/24 # vnc
5902 ALLOW 192.168.100.0/24 # vnc
One additional thing: Do I have a eth0 interface? My ZOTAC mini PC has two ethernet connections and I just was confused that eth0 does not come up. The script for setting the rules uses IFACE_INTERNAL=eth0. Could that be an issue?
$ ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 00:01:2e:4d:52:96 brd ff:ff:ff:ff:ff:ff
3: enp4s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
link/ether 00:01:2e:4d:52:9b brd ff:ff:ff:ff:ff:ff
4: wlp2s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 0c:d2:92:57:c2:53 brd ff:ff:ff:ff:ff:ff
Yes, The
iptables -F chainwill flush all of the iptables rules for that chain, and therefore only the default policy rule will be used.It seems likely that the default policy for your references was
ACCEPT, while the default policy on your computer isDROP.Check via
sudo iptables -xvnL. If you want to delete all of your rules in a chain, but maintain your ssh session, change the default policy toACCEPTfirst. You can change it back toDROPafter you have the rules you want in place, and you confirm your ssh packets are no longer relying on the default policy to get through.You might need it on the OUTPUT chain also.