Download your favorite Linux distribution at LQ ISO.
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 06-15-2012, 01:31 PM   #1
LQ Newbie
Registered: Jun 2012
Posts: 2

Rep: Reputation: Disabled
Iptables Drop rule


I have the below setup for my firewall and i am using iptables v

Client PC (eth0, Firewall Router (eth1, PC (

I have set the default policy as accept for my testing purpose. My aim is to prevent ssh from Client PC to Network PC. But allow ssh from Network PC to Client PC.

I have the following iptables rule

iptables -nvL
Chain INPUT (policy ACCEPT 744 packets, 46652 bytes)
pkts bytes target prot opt in out source destination
9989 780K ACCEPT all -- * * state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT 3 packets, 180 bytes)
pkts bytes target prot opt in out source destination
82 17854 ACCEPT all -- * * state RELATED,ESTABLISHED
11 660 DROP tcp -- * eth1 source IP range tcp spts:2:65535 dpt:22 destination IP range

Chain OUTPUT (policy ACCEPT 1741 packets, 149K bytes)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * eth1 source IP range tcp spt:22 dpts:2:65535 destination IP range

1. Ssh from Network PC to client PC --- ssh successful as expected
2. ssh from client pc to Network PC ---- ssh blocked as expected
3. Again ssh from Network PC to client PC --- ssh blocked which was not expected.
4. If i randomly insert some rules which has no relevance to ssh, and do step 1 alone again - ssh sucessful
5. Again do step 2 followed by step -- ssh blocked ..problem.

Please help or any idea will be very much appreciated

Also, noted that if i have a ssh rule to deny from client PC to network PC. If i do ftp, it is fine. But if i do ssh followed by ftp, ftp doesnt work. please note that default policy is accept all. I donot add or delete rules in between.

thanks and regards
Old 06-16-2012, 07:51 AM   #2
Registered: Apr 2009
Location: Oz
Distribution: slackware64-14.0
Posts: 875

Rep: Reputation: 282Reputation: 282Reputation: 282
Some pointers.

1. Traffic from the "Client PC" to the "Network PC" will not go through the INPUT or OUTPUT chains on the firewall machine, these chains are for traffic going to or from the firewall machine itself, traffic it forwards goes through the FORWARD chain only.

2. Remove the RELATED,ESTABLISHED rule from all chains while your running a permissive policy (ACCEPT on all chains is permissive)
2a. RELATED,ESTABLISHED rules should always go last as it can have unintended side effects

3. Your block rule, don't bother matching the source ports you only need the destination port 22 and add matching for state NEW, also you should use REJECT instead of DROP (performance reasons), the rest can stay the same.
Old 06-16-2012, 02:00 PM   #3
LQ Newbie
Registered: Jun 2012
Posts: 2

Original Poster
Rep: Reputation: Disabled
I found out the reason for dropping the packet.

On Debugging Kernel I found that in the forward path (ip_forward.c), a
particular part of code under a configuration flag
(CONFIG_NETFILTER_TABLE_INDEX) is getting executed and was giving the
wrong verdict of DROP for the packets.

I removed the same from .config file. Now the rules are working as

any way wildwizard thanks for your reply. i should think about the placement of STATEFUL inspection rule. Ideally i believe there is chance that someone can place drop rule at the last and other permissive rules at the top. Since these are configured from an application software i thought it i better to place stateful inspection rules at the beginning as i always want to allow the reply packets


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Prerouting with DROP as the default rule loureed4 Linux - Security 15 01-02-2015 03:20 PM
[SOLVED] iptables: drop rule mrmnemo Linux - Newbie 3 04-20-2010 11:14 PM
iptables - drop all -> allow needed OR allow all -> drop specific lucastic Linux - Security 5 12-21-2004 02:07 AM
how to drop all packets to one host with the default rule of accept dan5009 Linux - Security 1 08-20-2003 05:55 PM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 01:56 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration