[CentOS] iptables rules

Tue May 23 14:01:35 UTC 2006
Andrew Elliott <AndrewE at computar.ca>

Good morning,

First I would recommend using different rules for your INPUT and FORWARD
chains; it's 100 times easier to troubleshoot and can make things look a
lot simpler.  Second, I would refrain from posting any external ip
addresses on a public forum.

I'm not sure about your setup, but usually when you're creating rules
such as these, it's a good idea to start off with a default policy of
DROP for INPUT, OUTPUT and FORWARD.  From a security perspective it's
better to block everything and only allow what you're looking for.

Anyways, for your rules, I would replace "-A RH-Firewall-1-INPUT -i eth0
-s -j ACCEPT" and "-A RH-Firewall-1-INPUT -m tcp -p tcp
--dport 22 -j REJECT" with:

-A RH-Firewall-1-INPUT -i eth0 -p tcp -m tcp -s ! --dport
22 -j DROP

This will drop everything on eth0 going to port 22 from everywhere
except the ip address specified.  However, it's still easy to spoof an
ip address in order to get ssh access to this box.  I would really
recommend to set all your default policies to DROP though.  If you'd
like an exhaustive tutorial:


Andrew Elliott
Network Services
Computar Services Inc.
2191 Thurston Drive
>Ottawa, Ontario K1G 6C9
>Tel: (613) 482-8374
>Fax: (613) 737-3611
>Email: andrewe at computar.ca

-----Original Message-----
From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On
Behalf Of Abd El-Hameed Ayad
Sent: Tuesday, May 23, 2006 9:35 AM
To: centos at centos.org
Subject: [CentOS] iptables rules

  I have 2 CentOS servers & I want to deny
all ssh logins on port 22 on ( from any host except from

Can anybody tell me such iptables rules to write in
Currently, im using the following rules (on

:RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth1 -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -s -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j REJECT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

But i found that somebody is bypassing these rules & trying to 
authenticate with unknown (or wrong password)  accounts

Thanx in advance

CentOS mailing list
CentOS at centos.org