There are two things you should do to keep that system accessible before changing netfilter-rules:
- create an exception in the firewall rules for
ssh
from your machine
- create a safeguard
create an exception
create an appropriate rule with iptables
sudo iptables -A INPUT -p tcp --dport ssh --source-address yourextIPadd -j ACCEPT
(where yourextIPadd
is the IP address of your machine at home, seen from the outside)
or utilizing ufw
If you have ufw installed already you can tell ufw to create an exception
sudo ufw allow from yourextIPadd to any port 22
create a safeguard
Before issuing the command to alter the default-policy for netfilter to DROP
you can tell the system to revert that command after (say) 5 minutes with the handy command at
sudo at -vM now +5 minutes
now you are in something like an editor, where you can type commands to be executed later, you close/end that by typing CTRLD.
Type
/sbin/iptables --policy INPUT ACCEPT
CTRLD
You will see something like
sudo at -vM now +1 minute
Fri Aug 29 17:46:00 2014
warning: commands will be executed using /bin/sh
at> /sbin/iptables iptables --policy INPUT ACCEPT
at> <EOT>
job 5 at Fri Aug 29 17:46:00 2014
Remarks
- you need to call
at
with sudo
(it must be root's
at table)
- therefore no need for
sudo
within
-v
tells at
to show the intended execution time when you are finished
-M
tells at
to send no e-mail regarding success/failure
- for in-depth help with
iptables
have a look at the IPTables Howto