0

I have an issue with iptables where I'm unable to connect to localhost from localhost. Basically, I want all incoming packets, except those with a destination for SSH and port 9000 to be dropped. Packets with a destination for localhost:9000 must have a source port equal to port 8000.

Simple enough?

Why doesn't this work with the following rules? Note that this is inside a Vagrant instance (hashicorp/precise64).

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:8000 dpt:9000

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:ssh state ESTABLISHED

I attempt this with the following command:

# nc -p 8000 localhost 9000

-p sets the source port.

Which does nothing.

I've also tried to have no source port requirement for 8000, and only matching on the destination port, same result.

I add the rules like this:

Match both dpt and spt:

iptables -A INPUT -p tcp --sport 8000 --dport 9000 -j ACCEPT

Match only dpt:

iptables -A INPUT -p tcp --dport 9000 -j ACCEPT

As stated above, neither works.

Changing the policy on INPUT to ACCEPT makes it work, but why doesn't it work with DROP as the default policy when I have this specific rule to allow it?

Not that I think it matters, but the use case here is for port knocking. I'm aware I have to use /etc/knockd.conf to actually open and close the ports -- so far I'm only debugging. If I can't get it working from the command line manually, it will never work with knockd.

As requested, here is more verbose information:

# iptables -nvL --line-numbers
Chain INPUT (policy DROP 17 packets, 1164 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1    42847 1832K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
2        3   180 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:8000 dpt:9000

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 21 packets, 1420 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1    38138 3415K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:22 state ESTABLISHED


# iptables -t nat -nvL --line-numbers 
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
  • You don't need the OUTPUT rule if you've got policy ACCEPT. The config seems fine, but please add the output of iptables -nvL --line-numbers and iptables -t nat -nvL --line-numbers – Lenniey Nov 16 '18 at 12:04
  • @Lenniey thanks, I've provided the requested outputs in my edited post. I realize the OUTPUT rule isn't needed, it is a leftover from when the policy was DROP. However, removing the rule as it is now from OUTPUT doens't change anything (I've tried). – AlphaCentauri Nov 19 '18 at 7:22
0

The answer can be found here:

https://superuser.com/questions/808496/difference-between-iptables-default-policy-to-drop-and-inserting-a-seperate-po

iptables -I INPUT 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.