I'm running Arch Linux and I have a running SSH daemon to access my machine when I'm out side my LAN. I can do the connection, but iptables keeps blocking SSH Daemon, so I can only connect if I turn off the firewall. I'm running SSH on port 5000.My iptables rules*filter:INPUT DROP [0:0]:FORWARD DROP [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -p icmp -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -j REJECT --reject-with tcp-reset -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable -A INPUT -j REJECT --reject-with icmp-proto-unreachable # SSH-A INPUT -p tcp --dport 22 -j REJECT --reject-with icmp-host-unreachable-A INPUT -p tcp --dport 5000 -j ACCEPT# VNC-A INPUT -p tcp --dport 5001 -j REJECT --reject-with icmp-host-unreachable-A INPUT -p tcp -i lo -s 127.0.0.1/32 -d 127.0.0.1/32 --dport 5001 -j ACCEPT# HTTP/HTTPS-A INPUT -p tcp --dport 80 -j REJECT --reject-with icmp-host-unreachable-A INPUT -p tcp --dport 8080 -j REJECT --reject-with icmp-host-unreachable-A INPUT -p tcp --dport 443 -j REJECT --reject-with icmp-host-unreachable-A INPUT -p tcp -i lo -s 127.0.0.1/32 -d 127.0.0.1/32 --dport 80 -j ACCEPT
iptables and ssh
linux;arch linux;iptables;sshd
You have to reorder the iptables rules.You can't connect to your sshd because the rules are checked in line for line.And you already told iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset = reject ALL tcp traffic. Even you later tell him to accept connections to port 5000 it doesn't matter - you already rejected those connections.So when you write iptables rules, think about the order: first insert those things you want to allow, then reject the rest.