[chanalku91]

A few hours ago I tried studying iptables! But some errors made my VPS unable to connect! Is there a solution to this problem?

[Mashiro]

Your iptables rule allows connections from client port 9022 to server port 9022. However clients that connect to the server usually have a random port and hitting 9022 as its client port is a odd of 1 to 65535. The last rule you executed blocks all other connections. So you cannot connect to your VPS unless your client port is 9022.

Use the emergency console or emergency VNC in your control panel and delete all rules using:

Code: (Select All)

iptables -F
iptables -X

The correct rule to open port 9022 (TCP I assume) would be:

Code: (Select All)

iptables -A INPUT -p tcp --dport 9022 -j ACCEPT

You should be watching out what you are doing! If you set your INPUT chain to DROP make sure you have setup iptables rules properly or you will lock out yourself like you did.

You also need some more rules if you plan to leave the INPUT chain on dropped. Rules that allow replies to connections that you have started and etc.

See here: https://post4vps.com/Thread-Basic-secure...h-iptables

If you want to set this up properly do it over the emergency SSH / VNC so you can test if it works without being locked out.

[chanalku91]

    Here at least I found a problem That is when giving the command -P INPUT DROP It also blocks port 22

[Mashiro]

You didn't read what I have posted... Well.

Opening port 22 only and then setting your INPUT chain to DROP will NOT WORK! You need additional rules.

The order of how you execute the iptables rules also matters. You first opened port 22 and then said to DROP all traffic. The last rules in this case overrides all rules set before. So you get disconnected.

You need to use emergency SSH to setup the firewall properly. First setup the chains and to DROP then open ports as needed and setup further rules that allow automatic replies to connections you have initialized.

It is all described in the topic I linked in my previous post: https://post4vps.com/Thread-Basic-secure...h-iptables


Basically the script you need to run to do everything in a single run is:

Code: (Select All)

iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

Run this from a emergency SSH session or emergency VNC - NOT FROM THE VPS DIRECTLY! After running it you can attempt to connect.

[chanalku91]

Wow it works, but I don't have access to EMERGENCY VNC on the panel

[Mashiro]

Great to hear that it works.

You have no access to emergency SSH in your VPS control panel? Ok. How come? No VPS control panel? Usually SolusVM and Virtualizor both have either emergency SSH or VNC features.

Maybe open a support ticket?

[chanalku91]

I don't get access to SolusVM for security reasons for service providers!

So, the problem is Solved !
@Dynamo can you close this thread?

[deanhills]

Great to hear that it works.

You have no access to emergency SSH in your VPS control panel? Ok. How come? No VPS control panel? Usually SolusVM and Virtualizor both have either emergency SSH or VNC features.

Maybe open a support ticket?

It's an Admin managed VPS @"Hidden Refuge". It doesn't come with a reseller panel. I wish it did as @chanalku91 is a power user and keeping me busy with reinstalling the OS!

[deanhills]

@chanalku91 Further info from the sponsor (Greg) says VPS 16 is not as well protected with DDoS as VPS 17. Why not apply for VPS 17, and you'll then be the absolute best person to test how well their DDoS is working on VPS 17.