Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I changed my server SSH port to something else than port 22, however when I access to<ssh-port> I can see an output of

SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1

I want to block direct port access except SSH, how can I do this with the iptables?

share|improve this question
That's not "http access" to SSH. That's the SSH protocol banner. Since your browser can't negotiate SSH it represents the data as best it can, by simply displaying it. That's just how it works. Get over it. – bahamat Aug 2 '12 at 17:53

This is not something you can prevent with iptables, which doesn't examine the content of the traffic passing over the network. You could do what you want with an Application Firewall, but that might be overkill for your problem.

I would suggest that consider whether you really care so much about this issue to bother with all the extra effort of installing and configuring an application firewall. The effort might be better spent going through the options in the sshd_config file to ensure you have configured it as securely as you wish.

share|improve this answer

You can't. That's how the SSH-protocol works, the very first thing it does is tell you it's version.

You can also telnet to that same port and you will get the same result. The only thing iptables can do for you is only allow certain IP's from getting to that port.

share|improve this answer
So there is no way to block HTTP access but allow SSH? – MacMac Aug 2 '12 at 13:38
There is no such thing as HTTP access. What you get is the result from opening a socket on port xx (80) with that server. – Bart De Vos Aug 2 '12 at 14:19
Okay, so what about preventing a response like what Firefox does Unable to connect? – MacMac Aug 2 '12 at 14:48
That is client-side behavior. Because FF does not gat a valid HTTP-response, it just b0rkes out. IE just shows what it got back. So no, you can't alter the behavior. – Bart De Vos Aug 2 '12 at 16:28

This output is returned by SSH daemon to the connecting client. If you simply use:

$ telnet ip port
Trying ip...
Connected to ip.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1

You can find also the same line returned when using ssh -v -p port ip.

It is not clear what you want to do. You either allow access to this port or deny access. What do you mean by?

I want to block direct port access except SSH
share|improve this answer

By design, any application can connect to any IP port. Once the connection is established things then go up to the application level to communicate with each other. Direct port access is at a lower level than SSH. Port access is at the IP level, SSH is at the application level. Port connections are established before SSH is even a part of the picture. Once the port connection is established then SSH is able to start doing its thing.

You need an application level protocol analyzer to intercept connections on the port in order to do what you're thinking. That analyzer needs to be able to read connections on the port, look at the application level protocol involved, then block the connection based on what application level protocol is in use. I'm not an iptables expert, but I don't think that it can do this level of filtering. You probably need a more advanced firewall product to do this. (Someone can correct me if I'm wrong on that).

share|improve this answer

If I understand your question correctly... you've configured your ssh server to listen on port 80. HTTP traffic is typically done over port 80. When using a web-browser to connect to that box... you see the initial data sent by the ssh server.

If this is the case, there is nothing you can do with iptables to "block" web-browsers and only accept ssh clients. You either leave the port open... or you don't.

share|improve this answer

So, you're trying to do something like curl

Yes, in that case, you will get the SSH banner SSH-2.0-OpenSSH_5.3 or whatever it is you're using, and the HTTP browser will error out because it's not an HTTP response.

There's nothing you can do about that: it's the service advertising itself. See the FAQ:

You are first making a TCP connection (level 4). Once that happens, the applications (server and client) start talking to establish their communications. The server says SSH-2.0-OpenSSH_5.3, 220 ESMTP Postfix or whatever is appropriate to the protocol, and waits for the client. The client either recognizes what the server is (in which case they start communicating), or it bails out with a protocol mismatch (e.g., Firefox says that it can't connect). You can't really keep the banner from displaying after TCP establishes.

If you want to "block direct port access", you'll have to block it below the application level, perhaps with a firewall rule that prevents all connections to that port except for a whitelisted IP address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.