0

It is possible using iptables (on Debian) to block all inbound connections for all the ports with a port number over (as an example) 16000.

Like this (using 16000 as reference):

The port 15999 is open for input, instead from port 16000 to 65535 inbound connections are dropped.

2

If the ports are contiguous, like yours are, then use the

--destination-port,--dport [!] port[:port]

syntax to set up the range:

... --destination-port 16000:65535 ...
4

Use Multiport for that

iptables -A INPUT -p tcp --match multiport --dports 16000:65535 -j DROP

also you may try

iptables -A INPUT -p tcp  --dport 16000:65535 -j DROP
  • Multiport is only required if the ports are not contiguous – Jeff Schaller Apr 14 '16 at 17:46
  • I tested the second command successfully. As Jeff says, now the ports are contiguous. – Marcs Apr 14 '16 at 17:48
  • true :) it just to have whole picture, it is possible to do in both ways – vvchik Apr 14 '16 at 17:51
2

You have to block tcp and udp ports:

iptables -A INPUT -p tcp --match multiport --dports 16000:65535 -j DROP
iptables -A INPUT -p udp --match multiport --dports 16000:65535 -j DROP
  • 1
    quoting the manpage "Protocol all will match with all protocols and is taken as default when this option is omitted." (the OP didn't specify protocols) – Jeff Schaller Apr 14 '16 at 18:10
  • The problem is that -p all makes impossible to use --dport. From server fault: serverfault.com/questions/279361/iptables-p-all-dport – Marcs Apr 14 '16 at 18:49
  • 1
    I think -p all has problem with --dport not -p udp or -p tcp – PersianGulf Apr 15 '16 at 9:18
  • Yes, "-p all" doesn't makes the flag --dport available – Marcs Apr 15 '16 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.