Skip to content
Register

iptables rules blocking my own SSH

VPS Hosting by lee_mcr 9 replies 606 views
lee_mcr

Member OP

14 #1

Right then, I have gone and done a proper numpty thing. Was tightening up some rules on my Hostinger VPS, thought I was being clever with a default drop, and now I cannot SSH in. Provider console works, thank god, but I would rather not rebuild from scratch. I had:

iptables -P INPUT DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

...or so I thought. Clearly I missed something because the packet counter on that rule is not moving. Console shows I am locked out. Any ideas before I make it worse? Cheers lads

Honey badger don't care... about downtime
quinnbizz

Member

#2

You forgot the loopback.

...
kate3

Member

2 #3
quinnbizz said:
You forgot the loopback.

Correct. Your ESTABLISHED,RELATED rule is also missing, or your ordering is wrong. Without -I lo -j ACCEPT, local services break. Without the conntrack rule, return SSH traffic dies.

Virtualization tax: some OpenVZ hosts intercept iptables in the host kernel and your rules behave differently. Hostinger uses KVM so you have full netfilter, but that also means full rope to hang yourself.

Check from console:

iptables -L -n -v --line-numbers

Look for rule 1. If your DROP is rule 1 and lo is rule 5, traffic hits the floor first.

virsh list --all | wc -l: 47
AlexWei

Member

Singapore

#4

MTR from my HostHatch box to your Hostinger IP shows clean path, no loss, 34ms. Not a peer better issue, local rule problem. Your provider ASN peers well at LINX.

Host          Loss%   Snt   Last   Avg  Best  Wrst StDev
1. gateway     0.0%    10    0.3   0.4   0.2   0.8   0.2
2. core-lon    0.0%    10    1.2   1.3   1.1   2.1   0.3
3. peer        0.0%    10   34.1  34.2  33.9  35.4   0.4
jane_ffm

Member

#5
lee_mcr said:
Provider console works

Good news — that gives us a lifeline. A few quick things to check from console:

• Did your last `iptables-save` persist, or was this runtime only? If runtime, a reboot clears it.
• Is fail2ban running? Sometimes it adds its own INPUT chain that conflicts.
• Your SSH daemon — is it listening on 22, or did you move it previously?

Happy to check your specific Contabo setup via DM if you want a second pair of eyes. We see this more often than you would think.

— Jane @ Contabo

Single mode till I die 💀
MA

Member

#6

I run ZFS on my home auction servers and even then I keep a serial console cable taped to the rack. Your provider console is your IPMI. Use it, fix rules, install persistent-save wrapper. Or switch to a host with real rescue mode.

pieter_rtm

Member

#7

Steps to fix, to be honest:

1. Console in.
2. `iptables -F`
3. `iptables -P INPUT ACCEPT`
4. Add rules in correct order: lo first, then established, then ports, then drop.
5. `apt install iptables-persistent` or equivalent.
6. Save. Test from second session before closing console.

As said: ordering matters. Your drop policy is the last rule, not the first. Bullet lists prevent this.

Containers before it was cool
kenji3

Member

#8

Lo first, drop last. Learned that the hard way too

conbini > datacenter snacks
Budi

Member

#9

I did the exact same thing on a Hostinger box last month

quinnbizz

Member

#10

Packet counter not moving? Rule might be in wrong chain

...

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft