0

I am running Ubuntu server version 20.04. I have configured my ssh server to listen on an alternate port (port 40001) in my sshd_config file. I want to allow incoming traffic from anywhere on my local network (192.168.1.0/24) using TCP port 40001, and block all incoming traffic otherwise, particularly the wide area network (the rest of the internet). I do not want to be able to ssh into my server from outside of my local network.

EDIT: My setup is as follows...

  1. Main ISP Router, which has a public ip address, and then port forwards (80,443,40001) to a
  2. secondary router, which then port forwards (80,443,40001), to the Ubuntu server. The ubuntu server has a Wi-Fi card, as well as an ethernet adapter, however, only the wifi is being used. The Ubunut server is not being used as a router, but only as a webserver with ports 80,443, and ssh 40001 being utilized.

In short, here are my desired rules:

Allow port 40001/tcp on the local network (192.168.1.0/24). Deny everything else.

I would like to know how to do this from the command line in 2 different ways.

  1. The first way, would be using UFW (Uncomplicated Firewall).
  2. The second way would be to do this using iptables.

If anyone can help answer this, it would be much appreciated!

Improve this question
3
  • Read this very good tutorial about iptables: digitalocean.com/community/tutorials/… ( Iptables Essentials: Common Firewall Rules and Commands )
    – paladin
    Apr 21, 2021 at 16:46
  • For most folks, seems like this would be simpler to set up on the router than the server firewall.
    – user535733
    Apr 21, 2021 at 17:21
  • @user535733 It would be. However, I am looking to do it on the server itself
    – DanRan
    Apr 21, 2021 at 17:27

1 Answer 1

Reset to default
0

I can only answer part 2, the iptables way:

You have not made it clear to us how WAN sourced packets would get to your server in the first place, and that information might necessitate an edit to this answer. This answer assumes your server only has one NIC, and is not also acting as your router, which would require 2 NICs.

sudo iptables -A INPUT -i $EXTIF -m state --state NEW -p tcp -s 192.168.1.0/24 --dport 40001 -j ACCEPT
sudo iptables -A INPUT -i $EXTIF -m state --state NEW -p tcp -s 0.0.0.0/0 --dport 40001 -j DROP

These rules assumes that somewhere in the overall rule set there is a preceding:

sudo iptables -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT

Where $EXTIF is replaced by your NIC name. Which you might actually be able to leave out the interface specification for this application, but I didn't test it.

Improve this answer
4
  • So "sudo iptables -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT" should be the first line in my iptables?
    – DanRan
    Apr 28, 2021 at 20:58
  • I don't know your overall context, so don't know for certain, but it has to be before the other two rules I listed. Yes, it would probably be O.K. as the first rule in the INPUT chain.
    – Doug Smythies
    Apr 28, 2021 at 22:15
  • Sorry for the late response. I have updated my original post with an EDIT, that attempts to explain my setup and overall context. Would you mind taking a look and verifying that this use case is still okay to use "sudo iptables -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT" as the first line in my iptables?
    – DanRan
    May 24, 2021 at 21:07
  • What is your sub-net definition for your intermediate network, the one between the two routers? And do you want traffic from that sub-net to be allowed by your Ubuntu Server? If you do want the intermediate LAN traffic to be allowed, then you will need to have another iptables rule doing so. Otherwise, yes what I said stands.
    – Doug Smythies
    May 24, 2021 at 22:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .