I am trying to only allow SSH incoming and outgoings on my firewall, but the problem is that FTP can also be used even though I DROP at the end of the script# Incoming SSH$iptables -A INPUT -p tcp --dport ssh -j ACCEPT# Outgoing SSH$iptables -A OUTPUT -p tcp --dport ssh -j ACCEPTThe way I DROP is by:iptables -A INPUT -j DROPiptables -A OUTPUT -j DROPiptables -A FORWARD -j DROPThe result of iptables -L:Chain INPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  anywhere             anywhere            ACCEPT     all  --  anywhere             anywhere             ctstate ESTABLISHEDACCEPT     tcp  --  anywhere             anywhere             tcp dpt:sshACCEPT     tcp  --  anywhere             anywhere             tcp dpt:httpACCEPT     tcp  --  anywhere             anywhere             tcp dpt:httpsACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpcDROP       all  --  anywhere             anywhere            Chain FORWARD (policy DROP)target     prot opt source               destination         DROP       all  --  anywhere             anywhere            Chain OUTPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  anywhere             anywhere            ACCEPT     all  --  anywhere             anywhere             ctstate ESTABLISHEDACCEPT     tcp  --  anywhere             anywhere             tcp dpt:sshACCEPT     udp  --  anywhere             anywhere             udp dpt:domain ctstate NEWACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain ctstate NEWACCEPT     tcp  --  anywhere             anywhere             tcp dpt:httpACCEPT     tcp  --  anywhere             anywhere             tcp dpt:httpsDROP       all  --  anywhere             anywhere       SCRIPT:#!/bin/bashiptables=/usr/sbin/iptables$iptables -F$iptables -P INPUT$iptables -P OUTPUT$iptables -X$iptables -F -t nat$iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE$iptables -A INPUT -i lo -j ACCEPT$iptables -A OUTPUT -o lo -j ACCEPT$iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT$iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT$iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT$iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT$iptables -A OUTPUT --p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT$iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
Only allow SSH incoming and outgoing
ssh;firewall;ssh tunneling
The first line of each of your INPUT and OUTPUT chains accepts everything. You can remove them with these two commandsiptables -D INPUT 1iptables -D OUTPUT 1But be sure you will still have access (ideally physically at the console) before running them.Now you've provided your script it's possible to suggest alternatives#!/bin/bash -ePATH=/usr/sbin:$PATH# Reset to a sane state, even if just temporarilyiptables -P INPUT ACCEPTiptables -P OUTPUT ACCEPT# Erase all the rulesiptables -Fiptables -t nat -F# Simple NAT rule for outgoing trafficiptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE# Allow loopbackiptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPT# Allow the return half of established connectionsiptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT# Allow incoming and outgoing sshiptables -A INPUT -p tcp --dport 22 -j ACCEPTiptables -A OUTPUT -p tcp --dport 22 -j ACCEPT# You probably want other stuff permitted here such as DNS on 53/udp and 53/tcp# and maybe NTP on 123/udp# iptables -A OUTPUT -p udp --dport 53 -j ACCEPT# iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT# iptables -A OUTPUT -p udp --dport 123 -j ACCEPT# Default policy is to discard all trafficiptables -P INPUT DROPiptables -P OUTPUT DROP