Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

IPTables is running on my web server. I really need SSH dynamic port forwarding, but my IPTables DROP any INPUT/OUPUT connection, only allow some ports.

For FORWARD chain, I wrote these rules:

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --              tcpflags:! 0x17/0x02 state NEW
ACCEPT     all  -f              limit: avg 100/sec burst 100
ACCEPT     icmp --              limit: avg 2/sec burst 10
DROP       all  --              state INVALID

My rules can block any SSH dynamic port forwarding connection.

What rules I need to write? Don't tell me to "Disable IPTables", I need firewall to anti-cracker.

share|improve this question
If you think the first answer would be "Disable IPTables" you haven't been looking around this site long... we love questions like this :) – Kyle Smith Jan 29 '12 at 15:13
Yes, I'm new here. I know Severfault, Stackoverflow, or Superuser have lots of interesting question. So, I join to it. – 比尔盖子 Jan 30 '12 at 3:39
up vote 2 down vote accepted

I guess webserver's INPUT chain already allows ssh, forgive me for asking the obvious.

Now, for the dynamic (-D) tunneling, you need to also enable OUTPUT from webserver (any local port there) to desired remote host(s) and their port(s). By remote I mean those that you want to actually connect to via your dynamic tunnel.

So if you plan to use your tunnel to connect to host on port 443, then you need to ALLOW on webserver OUTPUT from any port to

FORWARD chain is completely irrelevant here.

share|improve this answer
Thanks. But, I need to control OUTPUT connection of my server. Because some crackers can make a "reverse connection", it means open a connection from server to cracker. It is terrible, it can bypass any INPUT control. – 比尔盖子 Jan 30 '12 at 3:41
Once again, I would specifically allow the output to hosts that I need to access with dynamic tunnel. So I don't understand what more "control" do you really wish to have. It would help if you describe how do you plan use the ssh dynamic tunel. – kubanczyk Jan 30 '12 at 12:28
OK, I will do it. – 比尔盖子 Jan 30 '12 at 15:12

Just to clarify on @kubanczyk's answer, the FORWARD chain is irrelevant as it only applies to incoming packets destined for an address other than the local host that should be routed through the local host. As the ssh daemon is accepting connections (INPUT chain) on tcp/22, then initiating connections (OUTPUT chain) on behalf of the client (because of -D), there is no packet forwarding occurring.

share|improve this answer
Thanks. I know FORWARD is not the problem now. But my problem is not solved, my problem is (Please see my comment for @kubanczyk. – 比尔盖子 Jan 30 '12 at 3:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.