Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to make possible communication from a client computer C1 to server S via router R. On my R i have set ip forwarding and with iptables I want to restrict communications only for ssh (and say web server, but now it's not important). What I don't know if sending and receiving of messages originate at port 22 and directed to port 22, or sending and receiving ports ar different.

Let's say may iptables are:

iptables -A FORWARD -s -d -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -d ??? -m state ESTABLISHED -j ACCEPT
iptables -A FORWARD -j REJECT

So what I have to specify for the second rule and why?

share|improve this question
up vote 0 down vote accepted

Only the SSH server listens on TCP port 22. The port used on the client side is generally not static, predictable, or even configurable. I suggest matching on the server's source port in your second rule:

iptables -A FORWARD -s -d -p tcp --sport 22 -m state ESTABLISHED -j ACCEPT
share|improve this answer
So you mean that ssh-server source port is also 22, like destination port (or maybe I'm confused about all this port stuff) ? – shadox Mar 6 '14 at 18:06
The server is using port 22. From the client's perspective, that's the destination port, but from the server's perspective, it's the source port. – James Sneeringer Mar 6 '14 at 19:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.