SSH stops at "using username" with IPTables in effect
- by Rautamiekka
We used UFW but couldn't make the Source Dedicated ports open, which was weird, so we purged UFW and switched to IPTables, using Webmin to configure.
If the inbound chain is on DENY and SSH port open [judged from Webmin], PuTTY will say using username "root" and stops at that instead of asking for public key pw. Inbound chain on ACCEPT the pw is asked. This problem didn't happen with UFW.
Picture of IPTables configuration in Webmin: http://s284544448.onlinehome.us/public/PlusLINE%20Dedicated%20Server,%20Webmin,%20IPTables,%200.jpgThe address is to the previous rautamiekka.org.
iptables-save when on INPUT DENY:
# Generated by iptables-save v1.4.8 on Wed Apr 11 16:09:20 2012
*mangle
:PREROUTING ACCEPT [1430:156843]
:INPUT ACCEPT [1430:156843]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1415:781598]
:POSTROUTING ACCEPT [1415:781598]
COMMIT
# Completed on Wed Apr 11 16:09:20 2012
# Generated by iptables-save v1.4.8 on Wed Apr 11 16:09:20 2012
*nat
:PREROUTING ACCEPT [2:104]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Wed Apr 11 16:09:20 2012
# Generated by iptables-save v1.4.8 on Wed Apr 11 16:09:20 2012
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1247:708906]
-A INPUT -i lo -m comment --comment "Machine-within traffic - always allowed" -j ACCEPT
-A INPUT -p tcp -m comment --comment "Services - TCP" -m tcp -m multiport --dports 22,80,443,10000,20,21 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m comment --comment "Minecraft - TCP" -m tcp --dport 25565 -j ACCEPT
-A INPUT -p udp -m comment --comment "Minecraft - UDP" -m udp --dport 25565 -j ACCEPT
-A INPUT -p tcp -m comment --comment "Source Dedicated - TCP" -m tcp --dport 27015 -j ACCEPT
-A INPUT -p udp -m comment --comment "Source Dedicated - UDP" -m udp -m multiport --dports 4380,27000:27030 -j ACCEPT
-A INPUT -p udp -m comment --comment "TS3 - UDP - main port" -m udp --dport 9987 -j ACCEPT
-A INPUT -p tcp -m comment --comment "TS3 - TCP - ServerQuery" -m tcp --dport 10011 -j ACCEPT
-A OUTPUT -o lo -m comment --comment "Machine-within traffic - always allowed" -j ACCEPT
COMMIT
# Completed on Wed Apr 11 16:09:20 2012
iptables --list when on INPUT DENY:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere /* Machine-within traffic - always allowed */
ACCEPT tcp -- anywhere anywhere /* Services - TCP */ tcp multiport dports ssh,www,https,webmin,ftp-data,ftp state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere /* Minecraft - TCP */ tcp dpt:25565
ACCEPT udp -- anywhere anywhere /* Minecraft - UDP */ udp dpt:25565
ACCEPT tcp -- anywhere anywhere /* Source Dedicated - TCP */ tcp dpt:27015
ACCEPT udp -- anywhere anywhere /* Source Dedicated - UDP */ udp multiport dports 4380,27000:27030
ACCEPT udp -- anywhere anywhere /* TS3 - UDP - main port */ udp dpt:9987
ACCEPT tcp -- anywhere anywhere /* TS3 - TCP - ServerQuery */ tcp dpt:10011
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere /* Machine-within traffic - always allowed */
The UFW rules prior to purging on INPUT DENY:
127.0.0.1 ALLOW IN 127.0.0.1
3306 DENY IN Anywhere
20,21/tcp ALLOW IN Anywhere
22/tcp (OpenSSH) ALLOW IN Anywhere
80/tcp ALLOW IN Anywhere
443/tcp ALLOW IN Anywhere
989 ALLOW IN Anywhere
990 ALLOW IN Anywhere
8075/tcp ALLOW IN Anywhere
9987/udp ALLOW IN Anywhere
10000/tcp ALLOW IN Anywhere
10011/tcp ALLOW IN Anywhere
25565/tcp ALLOW IN Anywhere
27000:27030/tcp ALLOW IN Anywhere
4380/udp ALLOW IN Anywhere
27014:27050/tcp ALLOW IN Anywhere
30033/tcp ALLOW IN Anywhere
