iptables rules are denying connections on my server and these connections should be allowed. They are SSH clients that should be allowed to connect.
Dec 3 16:22:49 server kernel: [4125974.777012] iptables denied: IN=eth0 OUT= MAC=<...> SRC=<...> DST=126.96.36.199 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=327 DF PROTO=TCP SPT=42962 DPT=CLIENTPORT WINDOW=64240 RES=0x00 SYN URGP=0
- DST=188.8.131.52 is the server's IP address
- MAC=<...> is the is the server's eth0 MAC address (redacted)
- SRC=<...> can be any IP address from the client's location (redacted)
- DPT=CLIENTPORT is from a range of ports I specify. Each client has a port number they use. The actual port number shows up in the syslog, of course.
The port number provided to the client is not for security.
sshd_config is hardened so that password login is not allowed, etc. Clients use key pairs to connect.
I need help with iptables rules that will allow these connections. Is it possible to specify a range of allowed ports for DPT?
current rules are:
# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere REJECT all -- anywhere 127.0.0.0/8 reject-with icmp-port-unreachable ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere tcp dpt:80 ACCEPT tcp -- anywhere anywhere tcp dpt:443 ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:22 ACCEPT icmp -- anywhere anywhere icmp echo-request LOG all -- anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: ' REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere
The only incoming connections that are required are for the webserver and SSH. I believe the existing iptables rules need to be completely revised. An example is appreciated.