Then again, with TCP, you could add ! -syn to prevent new connections, but with UDP that's not possible as return or reply packets are no different from initial packets on the low level. Of course you could limit that range more, but then you'd need to verify what range your system uses for outgoing connections. 8080 or 6667), even ones that are accidentally left running. This would also allow any connections to any servers running on the high ports (e.g. You'd need to replicate that for all other ports anything on the system needs to connect to, mirroring any rules in the OUTPUT chain.Īnother example might be something like this to accept packets to high ports, to allow reply packets to (any) outgoing connections: iptables -A INPUT -p tcp -dport 1024:65535 -j ACCEPT Would only allow replies to outgoing SSH connections (to port 22). Though note that something like this: iptables -A INPUT -p tcp -sport 22 -m state -state ESTABLISHED -j ACCEPT Security by obscurity.Ĭonntrack tracks the outgoing connections that were actually opened from your system instead, so tell iptables to accept incoming packets of ESTABLISHEDĬonnections, you know you get those and only those. If you're running any server on the machine, in any port, not just SSH, anyone can connect to it if they happen to guess to use 22 as the source port. This would allow any TCP connection with source port 22 from anywhere to any port on your machine, not just return packets of an outgoing SSH connection. Iptables -A INPUT -p tcp -sport 22 -m state -j ACCEPT