0

I have my raspberry pi 2 connected via Ethernet to our router which is connected to the internet. The Pi 2 is used as a media server but I would like to be able to ssh to the pi 2 and disable and enable when it should have access to the internet. Even if it doesn't have access to the internet I would like to be able to ssh to it from out internal network. Is there an easy way to do this instead of changing my router configuration and rebooting each time?

I can ssh to the pi 2 now I'm just not sure how to prevent it from getting or sending traffic over the internet.

PS: I'm using Linux raspberrypi 4.1.13-v7+ #826 SMP PREEMPT Fri Nov 13 20:19:03 GMT 2015 armv7l GNU/Linux Thanks

Improve this question
4
  • It might help if you explain why you are trying to do this.
    – Steve Robillard
    Mar 9, 2016 at 0:04
  • @SteveRobillard I'm trying to limit security issues I've been bit by the glibc ghost issue and there's more than likely something else out there in the wings. I'm sure anyone will agree having the ability to easily enable or disable if the pi 2 can route or receive anything from the internet is one less thing to worry about.
    – Rick T
    Mar 9, 2016 at 0:09
  • This will provide some benfit but it is a case of closing the door halfway not closing it fully and locking it. Locking down your router and proper firewalls would seem to be time better spent. If you are that concerned about the Pi pull the Ethernet cable when not in use. You could check if iptables is supported (you don't mention which distro etc. you are running) and configure it to allow SSH from your local IP (though IP's can be spoofed) and then add a pair of rules to close/open other ports (like 80 and 443) as needed. I would also make sure you are using passwordlesss SSH.
    – Steve Robillard
    Mar 9, 2016 at 0:11
  • @SteveRobillard the router is locked down but as we know routers are not often updated and some of them are "accidentally" left with holes in them cnet.com/news/wi-fi-routers-more-security-risks-than-ever is this not the right forum to ask this question? I'm using Linux raspberrypi 4.1.13-v7+ #826 SMP PREEMPT Fri Nov 13 20:19:03 GMT 2015 armv7l GNU/Linux
    – Rick T
    Mar 9, 2016 at 0:18

1 Answer 1

Reset to default
3

You can make firewall rules like this;

iptables --flush
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 255 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -d 0/0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited

That will permit ssh(22) in from anywhere and http(80) in from only your local network (assuming your gateway is 192.168.1.1).

The rules are obviously changeable via ssh, or you could just use a vpn and never expose anything on that NATed computer directly to the web.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.