firewall_src ignored

[salderma]

I think this is a clash of modules, but we noticed today that if we attempt to restrict access to the ssh port, via firewall_src param, the restrictions are ignored because there is a default accept rule at the top of the input chain.

-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp --dport 22 -s 192.168.1.0/24,10.72.10.10 -d 10.0.0.20 -j ACCEPT

I'm not sure where the rule originates, execpt that the iptables module defines such rule, but in my case we're not using the iptables module directly.

Is this something I can work to resolve?

Thanks.

[alvagante]

Yes, there's an option on the iptables module that enables ssh access by default (to prevent accidental lock offs).
Try to set safe_ssh => false on the iptables module