Iptables allow access via ssh tunnel to internal network

Question

I am trying to restrict access on a server only to ssh by doing this. This is working nicely

iptables -A INPUT -i eth0 -p tcp --dport $SSH_port -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport $SSH_port -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

However I would be using ssh port forwarding to access internal services in 127.0.0.1:port and in another internal_ip:port on a different virtual interface how can I achieve this?

The command that I'm using for ssh port forwarding:

ssh -2NqCgD 55555 -p $SSH_port user@server

I tried many combinations but with no success.

Excerpt from /var/log/auth.log

sshd[xxxx]: error: connect_to 127.0.0.1 port xxxxx: failed.
sshd[xxxx]: error: connect_to internal_ip port yyyyy: failed.

Answer 1

# Allow all on loopback
$IPTABLES -A INPUT -i lo  -s 127.0.0.1 -j ACCEPT 
$IPTABLES -A OUTPUT -o lo  -d 127.0.0.1 -j ACCEPT 

Answer 2

This rule worked for me. Order is important to iptables so placing the DROPs at the end did the trick.

iptables -A INPUT -i eth0 -p tcp --dport $ssh_port -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport $ssh_port -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT 
iptables -A OUTPUT -o lo -j ACCEPT 

iptables -A INPUT -i $internal_interface -j ACCEPT
iptables -A OUTPUT -o $internal_interface -j ACCEPT

iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP