mjhjmtu

I am making a bastion ssh server. When I use the following rules in its ip tables, I am able to connect to the server just fine:

Inbound Rules

• Allow traffic on port 22 from my client's IP


• Block all other traffic

Outbound Rules

• Allow all traffic to my client's IP


• Block all other traffic

My understanding is the server randomly chooses an outbound port to complete the ssh connection when a valid client calls.

1. What range of integers does the system select from to choose this
   port?


2. Can I tell my system which range of ports to use?

Your understanding is wrong :-). The client will choose a 'tcp-high port' to initiate traffic to the server's target port 22. The server will respond to the clients initiated source port.

For example, the client chooses port 12345 as source port to connect to the servers destination port 22. The server will try to send traffic from it's port 22 to the client on port 12345.

The tcp-high port range is from > 1024 to 65535.

Therefore you should allow RELATED and ESTABLISHED traffic to your client. For example:

IPTABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Ensure that the above rule comes before the 'block all the rest' rule.

Thanks a lot Lambert. It helped solved most of my problems.