Permitir somente entrada e saída SSH

Question

Estou tentando apenas permitir SSH de entrada e saída no meu firewall, mas o problema é que FTP também pode ser usado mesmo que eu DROP no final do script

# Incoming SSH
$iptables -A INPUT -p tcp --dport ssh -j ACCEPT

# Outgoing SSH
$iptables -A OUTPUT -p tcp --dport ssh -j ACCEPT

A maneira como eu DROP é:

iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
iptables -A FORWARD -j DROP

O resultado de iptables -L :

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
DROP       all  --  anywhere             anywhere       

SCRIPT:

#!/bin/bash
iptables=/usr/sbin/iptables

$iptables -F

$iptables -P INPUT
$iptables -P OUTPUT
$iptables -X

$iptables -F -t nat

$iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT

$iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
$iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

$iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
$iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
$iptables -A OUTPUT --p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
$iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

    

Answer 1

A primeira linha de cada uma das suas correntes INPUT e OUTPUT aceita tudo. Você pode removê-los com estes dois comandos

iptables -D INPUT 1
iptables -D OUTPUT 1

Mas certifique-se de que você ainda terá acesso (idealmente fisicamente no console) antes de executá-los.

Agora que você forneceu seu script, é possível sugerir alternativas

#!/bin/bash -e
PATH=/usr/sbin:$PATH

# Reset to a sane state, even if just temporarily
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT

# Erase all the rules
iptables -F
iptables -t nat -F

# Simple NAT rule for outgoing traffic
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow the return half of established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow incoming and outgoing ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT

# You probably want other stuff permitted here such as DNS on 53/udp and 53/tcp
# and maybe NTP on 123/udp
# iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
# iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
# iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

# Default policy is to discard all traffic
iptables -P INPUT DROP
iptables -P OUTPUT DROP