Post4VPS Forum | Free VPS Provider
iptables problem solving - Printable Version

+- Post4VPS Forum | Free VPS Provider (https://post4vps.com)
+-- Forum: VPS Discussion (https://post4vps.com/Forum-VPS-Discussion)
+--- Forum: VPS Support (https://post4vps.com/Forum-VPS-Support)
+--- Thread: iptables problem solving (/Thread-iptables-problem-solving)



iptables problem solving - chanalku91 - 07-22-2019

A few hours ago I tried studying iptables! But some errors made my VPS unable to connect! Is there a solution to this problem?


RE: iptables problem solving - Hidden Refuge - 07-22-2019

Your iptables rule allows connections from client port 9022 to server port 9022. However clients that connect to the server usually have a random port and hitting 9022 as its client port is a odd of 1 to 65535. The last rule you executed blocks all other connections. So you cannot connect to your VPS unless your client port is 9022.

Use the emergency console or emergency VNC in your control panel and delete all rules using:
Code:
iptables -F
iptables -X

The correct rule to open port 9022 (TCP I assume) would be:
Code:
iptables -A INPUT -p tcp --dport 9022 -j ACCEPT


You should be watching out what you are doing! If you set your INPUT chain to DROP make sure you have setup iptables rules properly or you will lock out yourself like you did.

You also need some more rules if you plan to leave the INPUT chain on dropped. Rules that allow replies to connections that you have started and etc.

See here: https://post4vps.com/Thread-Basic-secure-Firewall-setup-with-iptables

If you want to set this up properly do it over the emergency SSH / VNC so you can test if it works without being locked out.


RE: iptables problem solving - chanalku91 - 07-22-2019

[attachment=169]Here at least I found a problem That is when giving the command -P INPUT DROP It also blocks port 22


RE: iptables problem solving - Hidden Refuge - 07-22-2019

You didn't read what I have posted... Well.

Opening port 22 only and then setting your INPUT chain to DROP will NOT WORK! You need additional rules.

The order of how you execute the iptables rules also matters. You first opened port 22 and then said to DROP all traffic. The last rules in this case overrides all rules set before. So you get disconnected.

You need to use emergency SSH to setup the firewall properly. First setup the chains and to DROP then open ports as needed and setup further rules that allow automatic replies to connections you have initialized.

It is all described in the topic I linked in my previous post: https://post4vps.com/Thread-Basic-secure-Firewall-setup-with-iptables


Basically the script you need to run to do everything in a single run is:
Code:
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

Run this from a emergency SSH session or emergency VNC - NOT FROM THE VPS DIRECTLY! After running it you can attempt to connect.


RE: iptables problem solving - chanalku91 - 07-22-2019

Wow it works, but I don't have access to EMERGENCY VNC on the panel


RE: iptables problem solving - Hidden Refuge - 07-22-2019

Great to hear that it works.

You have no access to emergency SSH in your VPS control panel? Ok. How come? No VPS control panel? Usually SolusVM and Virtualizor both have either emergency SSH or VNC features.

Maybe open a support ticket?


RE: iptables problem solving - chanalku91 - 07-22-2019

I don't get access to SolusVM for security reasons for service providers!

So, the problem is Solved !
@Dynamo can you close this thread?


RE: iptables problem solving - deanhills - 07-22-2019

(07-22-2019, 12:30 PM)Hidden Refuge Wrote:  Great to hear that it works.

You have no access to emergency SSH in your VPS control panel? Ok. How come? No VPS control panel? Usually SolusVM and Virtualizor both have either emergency SSH or VNC features.

Maybe open a support ticket?

It's an Admin managed VPS @Hidden Refuge. It doesn't come with a reseller panel. I wish it did as @chanalku91 is a power user and keeping me busy with reinstalling the OS! Tongue


RE: iptables problem solving - deanhills - 07-28-2019

@chanalku91 Further info from the sponsor (Greg) says VPS 16 is not as well protected with DDoS as VPS 17. Why not apply for VPS 17, and you'll then be the absolute best person to test how well their DDoS is working on VPS 17.