NetFilter
[Top] [All Lists]

can't ssh outside with OUTPUT (policy ACCEPT)

To: netfilter@lists.netfilter.org
Subject: can't ssh outside with OUTPUT (policy ACCEPT)
From: "Maxim Veksler" <hq4ever@gmail.com>
Date: Wed, 8 Aug 2007 19:42:09 +0300
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=Mo+39S1mdOfE4jSjUTSHJpl5FrCIzcOGTXs48AHXph0w01b0ac5rdmUkGFRogzfSILt3lpc/RmaOqMTFworqlZ9vMjluY1ZoPPDFc+IyongCQp+PdwkNu7BeEP7ng9CiWp+hR9f/YxCdiNMiQfXwfLyJw0aLue+48tDONZneoqw=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=LhHWl47KYzn4t7MtvYPjYTQnjY9Cfr/gZX+7OVaxkWyrZLyIn1cRZHXP8s3jq2GB4+fsz4yE6CGHCFGM1z0qqsF9OQHDUpwYyuIdYc5aq/s/N+K8u+HK5ASMmh39Bm65s3v/nJBWeogxqGAexHU7/7QgAxnFNClhhl27cjglz38=
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Sender: netfilter-bounces@lists.netfilter.org
Hello,

Follwing a recent theread on this list, I've configued my firewall to
allow incoming traffic from specific IP's only. Now I can't ssh
outside, could some please explain why this happening ?

The system is redhat 4.

[root@prd-001 ~]# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  xxx.114.183.1        anywhere
ACCEPT     all  --  yyy.8.145.182        anywhere
ACCEPT     all  --  zzz.68.137.158       anywhere
ACCEPT     all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

[root@prd-001 ~]# iptables-save
# Generated by iptables-save v1.2.11 on Wed Aug  8 19:26:51 2007
*filter
:INPUT DROP [110564:24802104]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [637061:352312072]
-A INPUT -s xxx.114.183.1 -j ACCEPT
-A INPUT -s yyy.8.145.182 -j ACCEPT
-A INPUT -s zzz.68.137.158 -j ACCEPT
-A INPUT -i lo -j ACCEPT
COMMIT
# Completed on Wed Aug  8 19:26:51 2007


Trying to ssh to "aaa.bbb.216.35" fails with timeout, looking at
tcpdump on the otherside shows no TCP handshack is made.

Thank you for your help,
Maxim.

-- 
Cheers,
Maxim Veksler

"Free as in Freedom" - Do u GNU ?


<Prev in Thread] Current Thread [Next in Thread>