0

iptables rules are denying connections on my server and these connections should be allowed. They are SSH clients that should be allowed to connect.

syslog shows:

Dec  3 16:22:49 server kernel: [4125974.777012] iptables denied: IN=eth0 OUT= MAC=<...> SRC=<...> DST=11.22.33.44 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=327 DF PROTO=TCP SPT=42962 DPT=CLIENTPORT WINDOW=64240 RES=0x00 SYN URGP=0
  • DST=11.22.33.44 is the server's IP address
  • MAC=<...> is the is the server's eth0 MAC address (redacted)
  • SRC=<...> can be any IP address from the client's location (redacted)
  • DPT=CLIENTPORT is from a range of ports I specify. Each client has a port number they use. The actual port number shows up in the syslog, of course.

The port number provided to the client is not for security. sshd_config is hardened so that password login is not allowed, etc. Clients use key pairs to connect.

I need help with iptables rules that will allow these connections. Is it possible to specify a range of allowed ports for DPT?

current rules are:

    # iptables -L
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere
    REJECT     all  --  anywhere             127.0.0.0/8         reject-with icmp-port-unreachable
    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:80
    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:443
    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:22
    ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
    LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: '
    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination
    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere

The only incoming connections that are required are for the webserver and SSH. I believe the existing iptables rules need to be completely revised. An example is appreciated.

1

You are looking for the multiport iptables extension so put:

iptables -A INPUT -p tcp -m multiport --dports <port1>:<portn> -j ACCEPT

somewhere after rule 3 in your firewall script.

Remark: Rule 2 (rejecting packets destined to localhost) is weird: many local processes communicate over the lo interface. Usually you use the reverse rule:

iptables -A INPUT -i lo -j ACCEPT
2
  • I get the error invalid port/service 22000-22010 specified so I can guess this iptables doesn't have multiport support. – MountainX Dec 3 '19 at 22:54
  • Sorry, I put the wrong separator: - instead of :. – Piotr P. Karwasz Dec 4 '19 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.