iptables: block all inbound traffic over a certain port number

Question

It is possible using iptables (on Debian) to block all inbound connections for all the ports with a port number over (as an example) 16000.

Like this (using 16000 as reference):

The port 15999 is open for input, instead from port 16000 to 65535 inbound connections are dropped.

Jeff Schaller · Accepted Answer · 2016-04-14 17:35:45Z

2

If the ports are contiguous, like yours are, then use the

--destination-port,--dport [!] port[:port]

syntax to set up the range:

... --destination-port 16000:65535 ...

answered Apr 14 '16 at 17:35

Jeff Schaller♦

52.6k11 gold badges76 silver badges172 bronze badges

add a comment |

vvchik · Accepted Answer · 2016-04-14 17:44:53Z

4

Use Multiport for that

iptables -A INPUT -p tcp --match multiport --dports 16000:65535 -j DROP

also you may try

iptables -A INPUT -p tcp  --dport 16000:65535 -j DROP

answered Apr 14 '16 at 17:44

vvchik

1412 bronze badges

Multiport is only required if the ports are not contiguous – Jeff Schaller♦ Apr 14 '16 at 17:46
I tested the second command successfully. As Jeff says, now the ports are contiguous. – Marcs Apr 14 '16 at 17:48
true :) it just to have whole picture, it is possible to do in both ways – vvchik Apr 14 '16 at 17:51

add a comment |

PersianGulf · Accepted Answer · 2016-04-14 18:07:51Z

2

You have to block tcp and udp ports:

iptables -A INPUT -p tcp --match multiport --dports 16000:65535 -j DROP
iptables -A INPUT -p udp --match multiport --dports 16000:65535 -j DROP

answered Apr 14 '16 at 18:07

PersianGulf

8,2435 gold badges38 silver badges66 bronze badges

1

quoting the manpage "Protocol all will match with all protocols and is taken as default when this option is omitted." (the OP didn't specify protocols) – Jeff Schaller♦ Apr 14 '16 at 18:10
The problem is that -p all makes impossible to use --dport. From server fault: serverfault.com/questions/279361/iptables-p-all-dport – Marcs Apr 14 '16 at 18:49
1

I think -p all has problem with --dport not -p udp or -p tcp – PersianGulf Apr 15 '16 at 9:18
Yes, "-p all" doesn't makes the flag --dport available – Marcs Apr 15 '16 at 11:48

add a comment |

3 Answers 3