IPTables is running on my web server. I really need SSH dynamic port forwarding, but my IPTables DROP any INPUT/OUPUT connection, only allow some ports.

For FORWARD chain, I wrote these rules:

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --              tcpflags:! 0x17/0x02 state NEW
ACCEPT     all  -f              limit: avg 100/sec burst 100
ACCEPT     icmp --              limit: avg 2/sec burst 10
DROP       all  --              state INVALID

My rules can block any SSH dynamic port forwarding connection.

What rules I need to write? Don't tell me to "Disable IPTables", I need firewall to anti-cracker.

  • If you think the first answer would be "Disable IPTables" you haven't been looking around this site long... we love questions like this :) – Kyle Smith Jan 29 '12 at 15:13
  • Yes, I'm new here. I know Severfault, Stackoverflow, or Superuser have lots of interesting question. So, I join to it. – 比尔盖子 Jan 30 '12 at 3:39

I guess webserver's INPUT chain already allows ssh, forgive me for asking the obvious.

Now, for the dynamic (-D) tunneling, you need to also enable OUTPUT from webserver (any local port there) to desired remote host(s) and their port(s). By remote I mean those that you want to actually connect to via your dynamic tunnel.

So if you plan to use your tunnel to connect to host on port 443, then you need to ALLOW on webserver OUTPUT from any port to

FORWARD chain is completely irrelevant here.

  • Thanks. But, I need to control OUTPUT connection of my server. Because some crackers can make a "reverse connection", it means open a connection from server to cracker. It is terrible, it can bypass any INPUT control. – 比尔盖子 Jan 30 '12 at 3:41
  • Once again, I would specifically allow the output to hosts that I need to access with dynamic tunnel. So I don't understand what more "control" do you really wish to have. It would help if you describe how do you plan use the ssh dynamic tunel. – kubanczyk Jan 30 '12 at 12:28
  • OK, I will do it. – 比尔盖子 Jan 30 '12 at 15:12

Just to clarify on @kubanczyk's answer, the FORWARD chain is irrelevant as it only applies to incoming packets destined for an address other than the local host that should be routed through the local host. As the ssh daemon is accepting connections (INPUT chain) on tcp/22, then initiating connections (OUTPUT chain) on behalf of the client (because of -D), there is no packet forwarding occurring.

  • Thanks. I know FORWARD is not the problem now. But my problem is not solved, my problem is (Please see my comment for @kubanczyk. – 比尔盖子 Jan 30 '12 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.