Доброе время суток. Много времени не украду. Сильно не пинайте, только начинаю ориентироваться в линукс фаерволе. Настраиваю firewall для OpenVPN сервера. Создаю скрипт iptables.sh
#!/bin/bash
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT
iptables -A OUTPUT -j REJECT
# Allow all loopback (lo) traffic and reject anything
# to localhost that does not originate from lo.
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow ping and ICMP error returns.
iptables -A INPUT -p icmp -m state --state NEW --icmp-type 8 -j ACCEPT
iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
# Allow SSH.
iptables -A INPUT -i eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 32332 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m state --state ESTABLISHED --sport 32332 -j ACCEPT
# Allow UDP traffic on port 1194.
iptables -A INPUT -i eth0 -p udp -m state --state NEW,ESTABLISHED --dport 1194 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m state --state ESTABLISHED --sport 1194 -j ACCEPT
# Allow DNS resolution and limited HTTP/S on eth0.
# Necessary for updating the server and timekeeping.
iptables -A INPUT -i eth0 -p udp -m state --state ESTABLISHED --sport 53 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m state --state NEW,ESTABLISHED --dport 53 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED --sport 443 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 80 -j ACCEPT
iptables-A OUTPUT -o eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 443 -j ACCEPT
# Allow traffic on the TUN interface so OpenVPN can communicate with eth0.
iptables-A INPUT -i tun0 -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT
# Log any packets which don't fit the rules above.
# (optional but useful)
iptables -A INPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_INPUT_denied: " --log-level 4
iptables -A FORWARD -m limit --limit 3/min -j LOG --log-prefix "iptables_FORWARD_denied: " --log-level 4
iptables -A OUTPUT -m limit --limit 3/min -j LOG --log-prefix "iptables_OUTPUT_denied: " --log-level 4# chmod 0740 /etc/iptables.sh
# /etc/iptables.shИ все, сервер объявляет бойкот.
SSH настроен на PubkeyAuthentication без пароля.
Ввожу ssh user@XX.XX.XX.XX -p 32332
-Ничего.
Что я не правильно прописываю?
