Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup an iptables rule that will block access to ssh remote forwarded connections via ssh local remote forwarded connections. So, IOW:

Client A connects to server:
ssh -R 10000:localhost:23 someserver

Client B connects to server:
ssh -L 23:localhost:10000 someserver

I can't get iptables to block this. I need the forwarding in some cases which sshd_config settings can't cover (I will have a program specifically handing out the port that a client can forward on, and hopefully the program would then add an iptables rule to allow this).

I've tried:

iptables --flush

iptables -A INPUT -i lo -p tcp --dport 0:1024 -j ACCEPT
iptables -A OUTPUT -o lo -p tcp --dport 0:1024 -j ACCEPT
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

But it still allows ssh local forwarded connections to access the remote forwarded port. Any ideas on how to go about getting iptables to handle this?


EDIT:Tried changing to:

 
iptables --flush
iptables --policy INPUT DROP 
iptables --policy OUTPUT DROP 

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT 
iptables -A OUTPUT -o eth1 -p tcp --sport 22 -j ACCEPT 
iptables -A INPUT -j REJECT 

Still I can make the forwarded connections. So apparently that wasn't quite it. Thanx for the answer though. Do you have any other ideas for me?

share|improve this question
add comment

4 Answers

Would it not be easier to switch off ssh forwarding on the ssh server? Just change AllowTcpForwarding from yes to no in your /etc/ssh/sshd_config. If this doesn't suit, you could try something along the lines of

iptables -A OUTPUT -o eth1 -p tcp --cmd-owner "sshd" -j DROP
share|improve this answer
1  
I will be turning it back on for selective ports on a per user basis, so no this won't work, which I stated in my question. –  Oliver Nelson Aug 31 '09 at 2:26
    
Try the added rule? –  Cian Aug 31 '09 at 2:54
    
I don't have the ipt_owner module compiled in, but still, I'm trying to block traffic listening on high port numbers on loopback interface. Seems like it shouldn't require this module to do. Any clue why the broad rules i'm setting aren't catching this traffic? –  Oliver Nelson Aug 31 '09 at 3:01
add comment
up vote 3 down vote accepted

Figured it out. My original ruleset blocked everything just fine. The problem wass that on this server, localhost resolves (via /etc/hosts) to ::1 (the IPv6 loopback) first. These rules didn't work because of this. After I removed that entry from my /etc/hosts file, I was able to get it all working just fine. My test script looks like this:

#!/bin/bash
iptables --flush

iptables -A INPUT -i lo -p tcp --dport 0:1024 -j ACCEPT
iptables -A OUTPUT -o lo -p tcp --dport 0:1024 -j ACCEPT
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j REJECT

#iptables -I INPUT 1 -i lo -p tcp --dport 10001 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -I OUTPUT 1 -o lo -p tcp --dport 10001 -m state --state NEW,ESTABLISHED -j ACCEPT

With the last two lines enabled, I can open an ssh local forwarded connection on port 10001. With them disabled, I cannot. Perfect!

share|improve this answer
add comment

Forwarded connections will originate from the local system. You would need to remove the below rule that allows outbound connections, and then if needed replace it with a few rules that only allow outbound connections that you explicitly permit.

iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
share|improve this answer
    
Gave that a try, still works. Any other ideas? –  Oliver Nelson Aug 31 '09 at 2:23
add comment

Please take into consideration that in place of "localhost" can be used:

  • any loopback address 127.x.x.x
  • address of any network interface on server

and also you didn't wrote anything about client B attempting to connect directly to clientA:

ssh -L 23:clientA:80 someserver (I chose port 80 b/c maybe your firewall allows it outbound)

I am sorry, with all these (and more) options available, together with your very basic knowledge of iptables it is very likely you leave gaping holes in your setup. If anything really valuable is in stake, I'd suggest to ask someone who knows better to do it all.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.