关于iptables配置导致SSH断开及黑洞网络环境下端口静默配置的技术咨询

Hey there, let's walk through your problem step by step to figure out what went wrong and how to fix it:

1. 为什么那条iptables命令直接断开了你的SSH连接？ #

First, let's look at the command you ran:

sudo iptables -A OUTPUT -p tcp ! --sport 22 -j DROP

The core issue here depends on your OUTPUT chain's default policy:

• If your default policy was ACCEPT: In theory, SSH response packets have a source port of 22, so they shouldn't be matched by this rule. If you still got disconnected, either you had pre-existing rules in the OUTPUT chain that were blocking SSH traffic, or you might have mixed up --sport (source port) with --dport (destination port) by mistake.
• If your default policy was DROP: This rule only blocks TCP outbound packets that don't come from port 22. But packets from port 22 would fall through to the default DROP policy, getting discarded too. That's why your SSH connection died immediately—even the server's responses to your keystrokes were blocked.

Also, your approach was misaligned with your goal: you want the server to stay silent to external traffic (no PING replies, no SYN-ACK/RST), but this rule only targets TCP outbound traffic and ignores ICMP entirely. You should be controlling how the server responds to inbound traffic, not blindly blocking most outbound packets.

2. 如何恢复SSH连接？ #

If you're already locked out, you have two reliable options:

• Option 1: Use the server's physical/console access (like a data center terminal or your VPS provider's web-based console). Log in directly and clear all iptables rules to restore default connectivity:

  sudo iptables -F
  

  This flushes all custom rules, letting traffic flow normally again.
• Option 2: Restart the iptables service (if you didn't save the bad rule permanently):

  # For Ubuntu/Debian systems
  sudo systemctl restart iptables
  # For CentOS/RHEL systems
  sudo service iptables restart
  

  This will revert to the last saved rule set (or default if none were saved).

3. 正确配置：除SSH外实现静默黑洞环境 #

Your goal is to build a darknet/black hole setup where the server logs inbound traffic but sends no responses—while keeping SSH fully functional. Here's the right way to set this up:

Step 1: 先确保SSH流量不受影响 #

添加规则保证SSH的双向通信始终被允许：

# 允许入站的SSH连接请求（目标端口22）
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# 允许已建立SSH连接的出站响应（比如服务器给你的命令回显）
sudo iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

Step 2: 配置静默黑洞规则 #

处理TCP流量：

对外部发来的TCP SYN请求（新连接尝试），只记录不回复：

# 记录所有入站的TCP SYN包（新连接请求）
sudo iptables -A INPUT -p tcp --syn -j LOG --log-prefix "TCP_SYN_REQUEST: "
# 丢弃这些SYN包，不发送SYN-ACK或RST响应
sudo iptables -A INPUT -p tcp --syn -j DROP

处理ICMP（PING）流量：

对外部的PING请求，只记录不回复：

# 记录入站的ICMP echo请求（PING）
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j LOG --log-prefix "ICMP_PING_REQUEST: "
# 丢弃请求，不发送echo reply响应
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

处理其他入站流量：

记录并丢弃所有未被允许的入站流量：

# 记录所有未匹配规则的入站流量
sudo iptables -A INPUT -j LOG --log-prefix "UNHANDLED_INBOUND: "
# 设置INPUT链默认策略为DROP，拦截所有未被允许的入站流量
sudo iptables -P INPUT DROP

Step 3: 可选：锁定出站流量 #

如果要确保服务器除了SSH响应外，不主动发起任何外部连接，可以配置OUTPUT链：

# 再次确认允许SSH出站响应（已在上一步添加，这里做冗余保障）
sudo iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
# 设置OUTPUT链默认策略为DROP，拦截所有未被允许的出站流量
sudo iptables -P OUTPUT DROP

注意：如果你的服务器需要主动连接外部（比如系统更新、DNS查询），不要设置这条默认DROP，而是按需添加特定的允许规则。

保存规则（实现持久化） #

让规则在服务器重启后依然生效：

# Ubuntu/Debian系统
sudo iptables-save > /etc/iptables/rules.v4
# CentOS/RHEL系统
sudo service iptables save

备注：内容来源于stack exchange，提问作者Z4R1