Filtered address in can login

Grant Taylor gtaylor at
Wed Aug 17 07:06:11 CEST 2005

The only thing that comes to mind is that might be getting in under the "--state RELATED" rule if you had an outgoing connection to that IP it would possibly be able to get back in.

Grant. . . .

vladimir wrote:
> Hi, I have iptables-1.2.7a and 2.4.26 kernel and there is something
> strange.
> I have the following rule:
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A INPUT -s 0/0 --protocol tcp --destination-port 80 -j ACCEPT
> iptables -A INPUT -s IP_ADDR  --protocol tcp --destination-port 22  -j
> iptables -A INPUT -p tcp --syn -j DROP
> So I expect that only  the specified IP_ADDR can ssh to port 22 in my
> server.
> But in /var/log/secure I see that some other IP's for example
> try to login to ssh  with different user names to my
> server.
> However, then I try ssh to that server not from IP_ADDR I can not, as
> expected.
> Please tell me how this bypass my firewall.
> Thank you very much, 
> Vladimir

More information about the netfilter mailing list