4

I'm trying to setup an iptables rule that will block access to ssh remote forwarded connections via ssh local remote forwarded connections. So, IOW:

Client A connects to server:
ssh -R 10000:localhost:23 someserver

Client B connects to server:
ssh -L 23:localhost:10000 someserver

I can't get iptables to block this. I need the forwarding in some cases which sshd_config settings can't cover (I will have a program specifically handing out the port that a client can forward on, and hopefully the program would then add an iptables rule to allow this).

I've tried:

iptables --flush

iptables -A INPUT -i lo -p tcp --dport 0:1024 -j ACCEPT
iptables -A OUTPUT -o lo -p tcp --dport 0:1024 -j ACCEPT
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

But it still allows ssh local forwarded connections to access the remote forwarded port. Any ideas on how to go about getting iptables to handle this?


EDIT:Tried changing to:

 
iptables --flush
iptables --policy INPUT DROP 
iptables --policy OUTPUT DROP 

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT 
iptables -A OUTPUT -o eth1 -p tcp --sport 22 -j ACCEPT 
iptables -A INPUT -j REJECT 

Still I can make the forwarded connections. So apparently that wasn't quite it. Thanx for the answer though. Do you have any other ideas for me?

4 Answers 4

5

Would it not be easier to switch off ssh forwarding on the ssh server? Just change AllowTcpForwarding from yes to no in your /etc/ssh/sshd_config. If this doesn't suit, you could try something along the lines of

iptables -A OUTPUT -o eth1 -p tcp --cmd-owner "sshd" -j DROP
3
  • 1
    I will be turning it back on for selective ports on a per user basis, so no this won't work, which I stated in my question. Aug 31, 2009 at 2:26
  • Try the added rule?
    – Cian
    Aug 31, 2009 at 2:54
  • I don't have the ipt_owner module compiled in, but still, I'm trying to block traffic listening on high port numbers on loopback interface. Seems like it shouldn't require this module to do. Any clue why the broad rules i'm setting aren't catching this traffic? Aug 31, 2009 at 3:01
3

Figured it out. My original ruleset blocked everything just fine. The problem wass that on this server, localhost resolves (via /etc/hosts) to ::1 (the IPv6 loopback) first. These rules didn't work because of this. After I removed that entry from my /etc/hosts file, I was able to get it all working just fine. My test script looks like this:

#!/bin/bash
iptables --flush

iptables -A INPUT -i lo -p tcp --dport 0:1024 -j ACCEPT
iptables -A OUTPUT -o lo -p tcp --dport 0:1024 -j ACCEPT
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j REJECT

#iptables -I INPUT 1 -i lo -p tcp --dport 10001 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -I OUTPUT 1 -o lo -p tcp --dport 10001 -m state --state NEW,ESTABLISHED -j ACCEPT

With the last two lines enabled, I can open an ssh local forwarded connection on port 10001. With them disabled, I cannot. Perfect!

1
  • Do note that, at that point, anyone smart enough to forward their port explicitly via ::1 will bypass your rule. Note also that they could forward it to a local Unix socket and then pass it on from there via other means depending on what they're doing. Note also that if you're trying to block file transfers merely the shell access you're giving them is sufficient.
    – Perkins
    Jun 13, 2018 at 21:21
0

Forwarded connections will originate from the local system. You would need to remove the below rule that allows outbound connections, and then if needed replace it with a few rules that only allow outbound connections that you explicitly permit.

iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
1
  • Gave that a try, still works. Any other ideas? Aug 31, 2009 at 2:23
0

Please take into consideration that in place of "localhost" can be used:

  • any loopback address 127.x.x.x
  • address of any network interface on server

and also you didn't wrote anything about client B attempting to connect directly to clientA:

ssh -L 23:clientA:80 someserver (I chose port 80 b/c maybe your firewall allows it outbound)

I am sorry, with all these (and more) options available, together with your very basic knowledge of iptables it is very likely you leave gaping holes in your setup. If anything really valuable is in stake, I'd suggest to ask someone who knows better to do it all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .