Networking / Beginners

---

Configuring the Firewall for Remote SSH Administration

You want to SSH into your firewall to do remote administration. You might want to log in from over the Internet, or you might want to restrict SSH to LAN access only. You also want the option of restricting access to certain specific source IP addresses.

There are several ways to handle this. SSH has a number of access and authentication controls, so you should configure those first. Then, configure iptables to add another layer of access controls.

To restrict SSH access to LAN hosts only, add this rule:

$ipt -A INPUT -i $LAN_IFACE -p tcp -s 192.168.1.0/24 --dport 22 --sport \
1024:65535 -m state --state NEW -j ACCEPT

Of course, you must use your own LAN address and SSH port. To allow SSH logins via the WAN interface, use this rule:

$ipt -A INPUT -p tcp -i $WAN_IFACE --dport 22 --sport 1024:65535 \
-m state --state NEW -j ACCEPT

This rule accepts SSH logins on all interfaces:

$ipt -A INPUT -p tcp --dport 22 --sport 1024:65535 -m state --state NEW -j ACCEPT

Or, you may restrict SSH logins to a specific source IP address:

$ipt -A INPUT -p tcp -s 12.34.56.78 --dport 22 --sport 1024:65535 \
-m state --state NEW -j ACCEPT

If there are additional source IP addresses you wish to allow, each one needs its own separate rule.

Let's take a look at what these rules do:

-A INPUT -p tcp ! --syn -mstate --state NEW-j DROP

A subtle iptables gotcha is that the NEW state will allow TCP packets through that do not have the SYN flag set, so we must make sure that only SYN-flagged packets are allowed. SYN is always the first step in initiating a new TCP session, so if it isn't present, we don't want to accept the packet.

-A INPUT -i $LAN_IFACE -p tcp -s 192.168.1.0/24 --dport 22 --sport 1024:65535 -m state --state NEW -j ACCEPT

This accepts new SSH (TCP port 22) connections coming in on the LAN interface and from the local subnet only, from high-numbered ports. Anything originating from a privileged port is suspect.

-A INPUT -p tcp -i $WAN_IFACE -p tcp --dport 22--sport 1024:65535 -mstate --state NEW -j ACCEPT

This rule allows connections coming in on the WAN interface only, so LAN access is not allowed.

-A INPUT -p tcp --dport 22 --sport 1024:65535 -m state --state NEW -j ACCEPT

This rule accepts all new SSH connections from any host anywhere. Again, the new connection must come from an unprivileged port.

-A INPUT -p tcp -i $WAN_IFACE -s 12.34.56.78 --dport 22 --sport 1024:65535 -mstate --state NEW -j ACCEPT

This rule accepts incoming SSH on the WAN interface only, from the named IP address; all others are dropped.

You don't need to add the RELATED,ESTABLISHED states to the rules because there already is a global rule for this.