I've recently upgraded my Raspberry Pi from Raspbian 8 (Jessie) to 9 (Stretch). The Pi in accessible on my LAN both via IPv4 and IPv6. I have applied some iptables rules (IPv4 only) to block hosts that fail to authenticate multiple times via SSH. There are no iptables rules for IPv6 (yet).
But now iptables (on IPv4) blocks SSH connections from my workstation to the Pi if I try to connect more than one time. Specifically: I can successfully open a first SSH session via IPv4, but when I try to open another session simultaneously it locks me out. I can then only connect via IPv6, or I have to wait until the block time is over (10 minutes).
So far I wasn't able to find the cause of this problem. iptables is set up in a way that it logs all failed connection attempts in syslog, using the keyword "iptables denied". There I can see failed connections on my SSH port, which look like this:
$ tail -f syslog | grep "iptables denied" | grep "DPT=22"
Mar 29 15:39:45 raspberry kernel: [ 179.988501] iptables denied: IN=wlan0 OUT= MAC=b8:27:eb:16:b3:1d:e4:b3:18:e3:47:f7:08:00 SRC=192.168.133.51 DST=192.168.133.50 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=32145 DF PROTO=TCP SPT=58723 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0
This is the ruleset for iptables:
$ cat rules.v4
# Generated by iptables-save v1.6.0 on Mon Mar 26 22:54:58 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:LOG_AND_DROP - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 600 --hitcount 4 --name DEFAULT --mask 255.255.255.255 --rsource -j LOG_AND_DROP
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -s 192.168.133.0/24 -p igmp -m addrtype --dst-type MULTICAST -j ACCEPT
-A INPUT -s 192.168.133.1/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 192.168.133.0/24 -p udp -m udp --dport 137:138 -m addrtype --dst-type BROADCAST -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j DROP
-A FORWARD -j DROP
-A OUTPUT -j ACCEPT
-A LOG_AND_DROP -j LOG --log-prefix "iptables denied: " --log-level 7
-A LOG_AND_DROP -j DROP
COMMIT
# Completed on Mon Mar 26 22:54:58 2018
If you guys wish I can provide a full transcript of a successful SSH session (with maximum debug verbosity "-vvv") and also a failed connection attempt (if this helps debugging).