[SOLVED] iptables question: --dports option and context

johnnygear · 04-21-2012, 10:55 AM

Hi All,

Hoping someone has a little more experience with iptables than I - shouldn't be too hard.

I am just wondering if anyone can confirm whether or not the --dports option only works in some contexts or whether it can be used in place of the usual --dport option as a valid way to consolidate many rules into single multi-port rules.

eg.

iptables -A INPUT -p tcp -m tcp --dports 135,137,138,139 -m recent --name portscan --set -j DROP

Thanks,

Johnny

fukawi1 · 04-21-2012, 09:29 PM

What you are looking for is the multiport module...
Heres one I prepared earlier.

Code:

iptables -A lan-to-net -p tcp -m multiport --dports 1863,5222 -m comment --comment "Accept MSN XMPP(FB)" -j ACCEPT

You can also specify a range as such:

Code:

iptables -A INPUT -p tcp --dport 4000:4010 -j ACCEPT

johnnygear · 04-21-2012, 10:11 PM

Quote:

Originally Posted by fukawi1

What you are looking for is the multiport module...
Heres one I prepared earlier.

Code:

iptables -A lan-to-net -p tcp -m multiport --dports 1863,5222 -m comment --comment "Accept MSN XMPP(FB)" -j ACCEPT

You can also specify a range as such:

Code:

iptables -A INPUT -p tcp --dport 4000:4010 -j ACCEPT

Thanks for that. I have done some reading on the multiport module and think I now have a decent grasp of it's functionality.

I have revised my rule below for anyone interested. Let me know if I am missing something.

iptables -A INPUT -p tcp -m multiport --dports 135:139 -m recent --name portscan --set -j DROP

Regards,

Johnny

fukawi1 · 04-21-2012, 10:17 PM

You don't HAVE to use the multiport module to specify a range. But you do to specify none sequential ports.

Code:

iptables -A input -p tcp --dport 1000 -j ACCEPT # Valid
iptables -A input -p tcp --dport 1000:1100 -j ACCEPT # Valid
iptables -A input -p tcp --dport 1000,1010,1020 -j ACCEPT # Not Valid

iptables -A input -p tcp -m multiport --dports 1000,1010,1020 -j ACCEPT # Valid
iptables -A input -p tcp -m multiport --dports 1000:1100 -j ACCEPT # Valid

johnnygear · 04-21-2012, 10:18 PM

Quote:

Originally Posted by fukawi1

You don't HAVE to use the multiport module to specify a range. But you do to specify none sequential ports.

Code:

iptables -A input -p tcp --dport 1000 -j ACCEPT # Not Valid
iptables -A input -p tcp --dport 1000:1100 -j ACCEPT # Valid
iptables -A input -p tcp --dport 1000,1010,1020 -j ACCEPT # Not Valid

iptables -A input -p tcp -m multiport --dports 1000,1010,1020 -j ACCEPT # Valid
iptables -A input -p tcp -m multiport --dports 1000:1100 -j ACCEPT # Valid

Thanks for the clarification. I greatly appreciate it.

Regards,

Johnny