Industry Forums > Wireless Service Providers > ssh off in 450G but stil login attempts

ssh off in 450G but stil login attempts

Add the following to ip firewall filter before any rules that detect SSH logins.


add chain=input action=drop protocol=tcp dst-port=22


Because your SSH service is not running your script is detecting a failed login and still doing its job. With a filter rule that drops any packet on SSH port 22, the script or the router will never see it.

The input chain is only for packets directed at the router itself. This will not affect the forward chain.

The only advantage to leaving it the way it is, is that you get too see a log of IP's that are trying. Since they are likely running scripts, every IP address on the Internet will probably see these attempts.

reply to thewisperer
As bburley says, you need to have the firewall "ignore" SSH related packets by dropping them on the floor when they come in.

To put it a slightly different way, youve disabled the service, but the firewall is still configured to accept and process packets, before it will try and send them onwards to the host itself, at which point there is no service to receive the packet, so it will generate some kind of message back in response (like ICMP port unreachable or some such.)

reply to thewisperer
thank you both: learning every day!

reply to TomS_

reply to thewisperer
Or you can just leave it be and not do anything..
--
»www.wirelessdatanet.net

reply to Inssomniak
That too.