<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>OK its fixed.<br></div>
<div> </div>
<div>I removed the -i ppp0 and the -0 ppp0 from the two rules they were in.<br></div>
<div> </div>
<div>The script now reads as below Except for dropping (instead of rejecting) I think I'm now doing what I'm supposed to</div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><b><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif">read -p "Flush rules?"</span></b></span></b><br></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><b><span class="font" style="font-family:menlo, consolas, 'courier new', monospace, sans-serif"></span></b>iptables -P INPUT ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -P OUTPUT ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables –F<br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Accept connections to the loopback interface (localhost)?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A INPUT -i lo -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Accept connections from the loopback interface (localhost)?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A OUTPUT -o lo -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Allow outgoing connections?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A OUTPUT -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Drop all pings?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A INPUT -p icmp --icmp-type echo-request -j DROP</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Accept requested inbound traffic?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Accept new and established ssh from specified IP?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A INPUT -p tcp -s 107.132.57.128 --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Allow established ssh to specified IP?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A OUTPUT -p tcp -d 107.132.57.128 --sport 22 -m state --state ESTABLISHED -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Drop all other ssh attempts?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A INPUT -p tcp --dport ssh -j DROP</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Allow outbound http traffic?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Allow outbound https traffic?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Allow inbound http traffic?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Allow inbound https traffic?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Set policy: Drop forwarding connections?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -P FORWARD DROP</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Set policy: Drop other incoming connections?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -P INPUT DROP</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">read -p "Set policy: Drop outgoing connections?"</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div><b><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;">iptables -P OUTPUT DROP</span><span class="font" style="font-family: menlo, consolas, "courier new", monospace, sans-serif;"><br></span></b></div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<blockquote type="cite"><div> </div>
<div>On Wed, May 13, 2015, at 16:20, Rick Hornsby wrote:<br></div>
<blockquote type="cite"><div><div> </div>
<div> </div>
<div>one other note - at least for testing purposes you might want to use REJECT instead of DROP. When you use DROP the firewall does exactly what the word implies - it silently drops the packets to the floor and the application has no idea anything is wrong. It is forced to time out waiting for a response that will never come. With REJECT iptables sends an ICMP response immediately. That should help speed up your development and troubleshooting greatly.<br></div>
<div> </div>
<div><a href="http://ipset.netfilter.org/iptables.man.html">http://ipset.netfilter.org/iptables.man.html</a><br></div>
</div>
</blockquote></blockquote><div> </div>
</body>
</html>