Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to restrict access on a server only to ssh by doing this. This is working nicely

iptables -A INPUT -i eth0 -p tcp --dport $SSH_port -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport $SSH_port -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

However I would be using ssh port forwarding to access internal services in 127.0.0.1:port and in another internal_ip:port on a different virtual interface how can I achieve this?

The command that I'm using for ssh port forwarding:

ssh -2NqCgD 55555 -p $SSH_port user@server

I tried many combinations but with no success.

Excerpt from /var/log/auth.log

sshd[xxxx]: error: connect_to 127.0.0.1 port xxxxx: failed.
sshd[xxxx]: error: connect_to internal_ip port yyyyy: failed.
share|improve this question

2 Answers 2

# Allow all on loopback
$IPTABLES -A INPUT -i lo  -s 127.0.0.1 -j ACCEPT 
$IPTABLES -A OUTPUT -o lo  -d 127.0.0.1 -j ACCEPT 
share|improve this answer
1  
I would remove the source and destination specifications. Reason being is if a host talks to itself with its public IP, it will still go over the loopback interface. Though if we dont care about that, then your answer is fine. –  Patrick Oct 27 '11 at 13:46
    
Thanks Adrien and Patrick this worked for me partly. I figured out how it should work. See my answer –  pl1nk Oct 28 '11 at 11:11
up vote 0 down vote accepted

This rule worked for me. Order is important to iptables so placing the DROPs at the end did the trick.

iptables -A INPUT -i eth0 -p tcp --dport $ssh_port -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport $ssh_port -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT 
iptables -A OUTPUT -o lo -j ACCEPT 

iptables -A INPUT -i $internal_interface -j ACCEPT
iptables -A OUTPUT -o $internal_interface -j ACCEPT

iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.