0

iptables rules are denying connections on my server and these connections should be allowed. They are SSH clients that should be allowed to connect.

syslog shows:

Dec  3 16:22:49 server kernel: [4125974.777012] iptables denied: IN=eth0 OUT= MAC=<...> SRC=<...> DST=11.22.33.44 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=327 DF PROTO=TCP SPT=42962 DPT=CLIENTPORT WINDOW=64240 RES=0x00 SYN URGP=0
  • DST=11.22.33.44 is the server's IP address
  • MAC=<...> is the is the server's eth0 MAC address (redacted)
  • SRC=<...> can be any IP address from the client's location (redacted)
  • DPT=CLIENTPORT is from a range of ports I specify. Each client has a port number they use. The actual port number shows up in the syslog, of course.

The port number provided to the client is not for security. sshd_config is hardened so that password login is not allowed, etc. Clients use key pairs to connect.

I need help with iptables rules that will allow these connections. Is it possible to specify a range of allowed ports for DPT?

current rules are:

    # iptables -L
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere
    REJECT     all  --  anywhere             127.0.0.0/8         reject-with icmp-port-unreachable
    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:80
    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:443
    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:22
    ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
    LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: '
    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination
    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere

The only incoming connections that are required are for the webserver and SSH. I believe the existing iptables rules need to be completely revised. An example is appreciated.

1 Answer 1

1

You are looking for the multiport iptables extension so put:

iptables -A INPUT -p tcp -m multiport --dports <port1>:<portn> -j ACCEPT

somewhere after rule 3 in your firewall script.

Remark: Rule 2 (rejecting packets destined to localhost) is weird: many local processes communicate over the lo interface. Usually you use the reverse rule:

iptables -A INPUT -i lo -j ACCEPT
2
  • I get the error invalid port/service 22000-22010 specified so I can guess this iptables doesn't have multiport support.
    – MountainX
    Dec 3, 2019 at 22:54
  • Sorry, I put the wrong separator: - instead of :. Dec 4, 2019 at 3:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .