Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've a server abc.example.com and a remote desktop zzz.example.com. I'm using SSH over a custom port, say, 6789. Whenever my firewall is off, I'm able to connect to the server successfully. But, as soon as I start my firewall, in vain.

Moreover, I want to allow ssh session only between abc.example.com and zzz.example.com, for security reasons.

This is the rule that I have added to my iptables on the server,

iptables -A INPUT -s zzz.example.com -m state --state NEW,ESTABLISHED -p tcp --dport 6789 -j ACCEPT
share|improve this question
When you append that to the bottom of your rule set, is it below any reject rule that is being matched before your new rule matches? – llua May 24 '13 at 12:36
no, in fact I do not have any reject rule in the iptables. Moreover, it works without -s parameter. But, that would make the system vulnerable as it would allow anyone to connect. – FireAndIce May 24 '13 at 12:47
Is the remote desktop machine behind a firewall with respect to the server? – John May 24 '13 at 13:55
yes, I'm using iptables as firewall. – FireAndIce May 25 '13 at 1:50

If you are missing a rule to enable traffic from ESTABLISHED connections, then you will need a rule allowing traffic from your host to the remote system. It is common to have a first rule like this:

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Then you can enable your access with a rule like:

iptables -A INPUT -s zzz.example.com -p tcp --dport 6789 -j ACCEPT

Alternatively you can use a firewall builder like shorewall and enable port knocking to open the port for a few seconds when needed.

If your ssh daemon supports tcp_wrapers, then you can limit access with the /etc/hosts.allow and /etc/hosts.deny files. Even if you have fixed the firewall, you may want to look at using this capability to notify you when remote connections are made. The following rules blocks a number of country domains, and send an email on every succ

sshd :          ALL \
            EXCEPT .ar .au .br .by .cl .co .cz .do .eg .gt \
                .id .il .in .jp .ma .mx .nl .pe .pk .pl .pt \
                .ro .rs .ru .sa .sg .tr .tw .ua .vn .za \
                .ae .at .bg .gh .hr .hu .ke .kz .lt .md \
                .my .no .sk .uy .ve : \
            spawn (/bin/echo "SSH connection to %N from %n[%a] allowed" | \
                /usr/bin/mailx -s "SSH Allowed" you@example.com)

EDIT: Using domain names in rules is not a good idea:

  • DNS lookups may not be available when the rules are loaded. (This is when the name gets converted to an IP address.)
  • Clients without static IP addresses may get new addresses, which are not available due DNS caching. Old IP addresses may be left with access, while the new address doesn't have access. Static IP addresses with local host entries work reasonably reliably.

If you have a dynamic address either secure access from a relatively large IP address range, or use port knocking. You can use fail2ban or a similar program to lock out addresses which are probing your ssh service. tcpwrappers can be used as above to put restrictions on which addresses can connect, and add additional logging. If you don't connect often, you may want to log successful as well as unsuccessful attempts.

share|improve this answer
BillThor, firstly I apologize for late reply. Now, I've tried what you said, but it didn't work. However, when I write the latter rule, it shows me something like this in the iptables, 115-111-201-123.static.zzzbroadband.yy.57150. Then I checked the tcpdump on the port. I found it to be communicating from a different address. I did a traceroute from server to desktop and vice versa. Found out that I need to add one more rule 116-111-254-123.static.zzzbroadband.yy. It worked. Is it because I'm using a dns service instead of static ip? – FireAndIce May 27 '13 at 5:41
Either your dyndns entry is incorrect, or your IP address changed after the rule was loaded. If you have a host entry, it may override the DNS entry. The DNS lookup will be done once when you start your rules (and will fail if DNS is not reachable). Consider using port knocking, or reloading the rule when the IP address changes (whenever your dyndns update needs to run. DNS caching may cause the old IP address to be used. – BillThor May 30 '13 at 5:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.