Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What the difference between these two or are they essentially the same thing?

iptables -t filter -A FORWARD -s $EXTERNALNET -d $INTERNALNET -p tcp --dport 22 -j ACCEPT
iptables -t filter -A FORWARD -s $INTERNALNET -d $EXTERNALNET -p tcp --sport 22 -j ACCEPT
share|improve this question
At first blush, these look functionally identical, however I think further testing would be required to be certain. – Peter Grace Oct 24 '12 at 20:33
They are not identical at all. – Falcon Momot Oct 24 '12 at 20:42
Ah, I see the error in my logic. You're 100% correct, they'd not be identical, they'd instead be two sides of the same tcp connection, but not the same atomic packet. – Peter Grace Oct 24 '12 at 20:46
@PeterGrace not even necessarily the same connection. Consider an outbound TCP connection to an arbitrary port (e.g. 80/tcp) with source port 22. It would be allowed, even though the intent is probably to only allow inbound connections to an SSH server. – bonsaiviking Oct 24 '12 at 20:48
Ah, you're right. Sneaky. I admit defeat and reward you with 1 internet. – Peter Grace Oct 24 '12 at 20:51

The first rule accepts traffic being forwarded from $EXTERNALNET to $INTERNALNET with destination port 22/tcp.

The second rule accepts traffic being forwarded from $INTERNALNET to $EXTERNALNET with source port 22/tcp.

In a proper configuration of a stateful firewall like iptables, there should be no need for rules to allow traffic based on source port, since both directions of validly established TCP streams are allowed. Doing otherwise can lead to security holes--in this case, allowing all outbound traffic so long as it has a source port of 22/tcp.

With a non-stateful configuration, the example given is probably about the best that can be accomplished.

share|improve this answer
Note that iptables does not implicitly allow related traffic, that is configured by explicitly adding a "-m state --state ESTABLISHED,RELATED -j ACCEPT" rule. It only becomes stateful if you configure it as such. – Peter Grace Oct 24 '12 at 20:38
That is why I emphasized "proper configuration." – bonsaiviking Oct 24 '12 at 20:39
Yes, but how is someone who is not used to setting up iptables supposed to know what "proper configuration" is? – Peter Grace Oct 24 '12 at 20:49

-s is source, and -d is destination, so these rules are in relation to traffic fowing in either direction.

the $INTERNALNET & $EXTERNALNET are variables, likely of a subnet or network range. I'm assuming this is from a bash script you got somewhere ?

share|improve this answer
--dport 22 ACCEPT

This directive tells the firewall to allow traffic destined for port 22 to pass through to your server.

--sport 22 ACCEPT

This directive tells the firewall to allow traffic sent from port 22 of outside machines to pass through to your server.

share|improve this answer
--sport is the source port on the packet. Whether it's being sent from your machine or received on your machine is irrelevant, it's purely based on the source port as defined in the packet header. – Peter Grace Oct 24 '12 at 20:35
You are entirely correct. Editing answer to reflect. – RWC Oct 24 '12 at 20:37
Also FORWARD refers to traffic going through the machine, not to or from it, and the host the packet came from may be either inside or outside the network. The router itself is not involved. – Falcon Momot Oct 24 '12 at 20:41
Edited my answer to reflect the specific --dport ACCEPT and --sport ACCEPT directives. – RWC Oct 24 '12 at 20:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.