iptables blocking ssh communication
- by Michal Sapsa
I'm using this script for iptables:
#!/bin/sh
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t filter
iptables -X -t filter
iptables -t filter -P FORWARD DROP
iptables -t filter -A FORWARD -s 192.168.0.0/255.255.0.0 -d 0/0 -j ACCEPT
iptables -t filter -A FORWARD -s 0/0 -d 192.168.0.0/255.255.0.0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.1/255.255.255.0 -j MASQUERADE
iptables -A FORWARD -s 10.8.0.1/255.255.255.0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 0/0 -j MASQUERADE
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t nat -A PREROUTING -i eth1 -p udp --dport 16161 -j DNAT --to 192.168.0.251:16161
iptables -t nat -A PREROUTING -i eth1 -p udp --sport 16161 -j DNAT --to 192.168.0.251:16161
#openvpn
iptables -I INPUT -p tcp --dport 1194 -j ACCEPT
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
I end up with some iptables rules that should work but don't work - probably because of me.
# Generated by iptables-save v1.4.12 on Mon May 26 13:15:43 2014
*raw
:PREROUTING ACCEPT [1657523:1357257330]
:OUTPUT ACCEPT [36804:34834370]
-A PREROUTING -p icmp -j TRACE
-A PREROUTING -p tcp -j TRACE
-A OUTPUT -p icmp -j TRACE
-A OUTPUT -p tcp -j TRACE
COMMIT
# Completed on Mon May 26 13:15:43 2014
# Generated by iptables-save v1.4.12 on Mon May 26 13:15:43 2014
*nat
:PREROUTING ACCEPT [5033:345623]
:INPUT ACCEPT [154:34662]
:OUTPUT ACCEPT [6:1968]
:POSTROUTING ACCEPT [2:120]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 16161 -j DNAT --to-destination 192.168.0.251:22
-A PREROUTING -i eth1 -p tcp -m tcp --dport 16161 -j DNAT --to-destination 192.168.0.251:22
-A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
-A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE
COMMIT
# Completed on Mon May 26 13:15:44 2014
# Generated by iptables-save v1.4.12 on Mon May 26 13:15:44 2014
*filter
:INPUT ACCEPT [548:69692]
:FORWARD DROP [8:384]
:OUTPUT ACCEPT [2120:1097479]
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -s 192.168.0.0/16 -j ACCEPT
-A FORWARD -d 192.168.0.0/16 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -i eth1 -o eth0 -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT
TRACE at PREROUTEING AND OUTPUT are only for debuging this thing.
When I ssh at public ip with port 16161 I don't get any message, only TimeOut so it looks like I don't get communication back to remote server.
ETH0 is the world, ETH1 is LAN
Any IPTABLES Masters willing to give a hand ?
iptables -vL
Chain INPUT (policy ACCEPT 20548 packets, 3198K bytes)
pkts bytes target prot opt in out source destination
38822 7014K ACCEPT udp -- any any anywhere anywhere udp dpt:openvpn
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:openvpn
Chain FORWARD (policy DROP 1129 packets, 64390 bytes)
pkts bytes target prot opt in out source destination
214K 11M TCPMSS tcp -- any any anywhere anywhere tcpflags: SYN,RST/SYN TCPMSS clamp to PMTU
4565K 1090M ACCEPT all -- any any 192.168.0.0/16 anywhere
5916K 7315M ACCEPT all -- any any anywhere 192.168.0.0/16
0 0 ACCEPT all -- any any 10.8.0.0/24 anywhere
0 0 ACCEPT tcp -- any any anywhere 192.168.0.251 tcp dpt:16161
Chain OUTPUT (policy ACCEPT 59462 packets, 19M bytes)
pkts bytes target prot opt in out source destination
