[SOLVED] iptables preventing ssh within local network

Question

I have updated my machines and removed tcp_wrappers.  I have iptables set to reject as default on my input chain.   I can ssh from one machine to another no problem as long as I stop iptables on the client first.  I tried adding a rule to my iptables script as mentioned in
https://bbs.archlinux.org/viewtopic.php?id=122651
modifying only as needed for my own local network:
iptables -A INPUT -p tcp -s 192.168.1.0/100 --dport ssh -j ACCEPT
but still I can ssh to the client only if I stop iptables.
Is there something wrong with the above rule?  How do I set up iptables to allow ssh from 192.168.1.0/100?
Thanks.
Last edited by kekules_dream (2011-07-24 19:18:05)

Answer 1

Thanks for that info I understand now the points about CIDR masks.  However, my iptables configuration is still preventing ssh locally, with:
ssh: connect to host 192.168.1.148 port 22: Protocol not available
netstat -tnlp | grep ssh
shows that ssh is running and listening.  The problem must be in my iptables setup script since I still have no problems with ssh if I stop iptables.
Could there be something wrong with my script?  It is now completely up to date with the Simple Stateful Firewall wiki and contains the line for allowing all local ssh, yet still it is blocking.  I make sure to stop iptables when I clear the rules or reload new ones.  Iptables is current, too, 1.4.11.1-1.  I have tried 100/32 also and this too blocks.
#!/bin/sh
iptables -N TCP
iptables -N UDP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -p icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
iptables -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreach
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-rst
iptables -A INPUT -j REJECT --reject-with icmp-proto-unreach
iptables -I TCP -p tcp -m recent --update --seconds 60 --name TCP-PORTSCAN -j REJECT --reject-with tcp-rst
iptables -D INPUT -p tcp -j REJECT --reject-with tcp-rst
iptables -A INPUT -p tcp -m recent --set --name TCP-PORTSCAN -j REJECT --reject-with tcp-rst
iptables -I UDP -p udp -m recent --update --seconds 60 --name UDP-PORTSCAN -j REJECT --reject-with port-unreach
iptables -D INPUT -p udp -j REJECT --reject-with icmp-port-unreach
iptables -A INPUT -p udp -m recent --set --name UDP-PORTSCAN -j REJECT --reject-with icmp-port-unreach
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport ssh -j ACCEPT
/etc/rc.d/iptables save