Were setting up a firewall for a machine that should allow:incoming SSH connections from particular IP addresses;ICMP, except for redirect.Weve opted to use REJECT over DROP, at least until weve finished our current testing.*filter# Allow all loopback (lo0) traffic and reject traffic to localhost that does not originate from lo0.-A INPUT -i lo -j ACCEPT-A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT# Reject ICMP redirect.-A INPUT -p icmp --icmp-type 5 -j REJECT# Allow ICMP (the types which are not rejected).-A INPUT -p icmp -j ACCEPT# Allow SSH connections from specific address-A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT# Allow inbound traffic from established connections, including ICMP error returns.-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT# Log what was incoming but denied (optional but useful).-A INPUT -m limit --limit 5/min -j LOG --log-prefix iptables_INPUT_denied:  --log-level 7# Reject all other inbound.-A INPUT -j REJECT# Log any traffic which was sent to you for forwarding (optional but useful).-A FORWARD -m limit --limit 5/min -j LOG --log-prefix iptables_FORWARD_denied:  --log-level 7# Reject all traffic forwarding.-A FORWARD -j REJECTCOMMITThe machine is behind a NAT router, and port 22 is forwarded to it.When attempting to connect from an unauthorised IP address, the connection to the host times out after a minute or so.ssh: connect to host x.x.x.x port 22: Connection timed outIs this expected? I was thinking the REJECT would result in fairly immediate connection failure. Could it be because the REJECT ICMP packet does not make it back to the connecting machine?
Is an SSH connection timeout expected when iptables is set to REJECT?
ssh;iptables;timeout