For example, I get a lot of UDP calls:

tcpdump incoming connections UDP

I need to block all connections that are NOT initiated by the client from port 27005.

I think this code should work:

iptables -A INPUT -p udp --sport :27004 -j REJECT iptables -A INPUT -p udp --sport 27006: -j REJECT iptables -A INPUT -p udp --sport 27005 -j ACCEPT

But it does not work.

What could be the problem?

  • 1. How did you define “inoperability”? Please indicate this directly in the question, please. 2. you add netfilter rules to the end of the filter table. what else is in it? sudo iptables-save -t filter . - aleksandr barakin
  • if the filter table already has rules that allow acceptance of packets that you are trying to reject , it makes sense not to add new rules ( -A ) to the end of the table, but to insert them into the beginning ( -I ). - aleksandr barakin pm
  • The file looks like this #!/bin/bash PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin export DISPLAY=:0.0 iptables -I INPUT -s 31.204.100.0/22 -j REJECT iptables -A INPUT -p udp --sport :27004 -j REJECT iptables -A INPUT -p udp --sport 27006: -j REJECT iptables -A INPUT -p udp --sport 27005 -j ACCEPT iptables -I INPUT -s 95.213.195.1 -j ACCEPT - Pharma
  • It does not work. This screenshot was taken after the commands iptables -A INPUT -p udp --sport: 27004 -j REJECT iptables -A INPUT -p udp --sport 27006: -j REJECT iptables -A INPUT -p udp --sport 27005 -j ACCEPT The TCP did not have to show these lines, as far as I understand, but showed - Pharma
  • The file above (bash script) is started by the crown at the start of the system. - Pharma

1 answer 1

Two things:

  1. Use -I instead of -A , then you guarantee that the rule is added to the beginning of the chain, and nothing prevents it.
  2. Control the health of the chain with the -j LOG rule at the end, rather than with tcpdump .

tcpdump cannot, in principle, show what iptables does, because it works on the interface (between the link and the network layer), and the traffic starts being processed by iptables / netfilter later.

Otherwise, you have everything right.