Blocking SSH ... BUT...

[Mike Wright]

Ashley M. Kirchner wrote:
> 
>    Hey all,
> 
>    I have the following lines in my iptables config file to curb ssh 
> knocking on our servers:
> 
> # Let's see if we can curb SSH attacks.
> -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set
> 
> -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --rcheck 
> --seconds 120 --hitcount 2 -j LOG  -log-prefix "SSH REJECT: "
> 
> -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --rcheck 
> --seconds 120 --hitcount 2 -j REJECT --reject-with tcp-reset
> 
> 
>    This works great...EXCEPT it also blocks our own access to the 
> servers if we need to get on them in a short amount of time (less than 
> 120 seconds).  So how can I still implement the above blocking, but 
> allow anything from our different subnets (we have 4) come through 
> without going through that block routine?
> 

Allow your subnets before the above rules.  Here's a sample rule:

-A INPUT -s 10.0.0.0/24 -p tcp --dport 22 --syn -j ACCEPT
# subnet    ^^^^^^^^^^^

You'd need one rule for each subnet.

hth