Iptables setting multiple multiports in one rule

user_321957 0
Viewed 115729

The multiport extension has a limit (15) for the ports that can be specified.

But I need to specify much more port numbers in a single rule, so I tried to use several multiport in one rule like:

iptables -A INPUT -p tcp -m multiport --destination-ports 59100 -m multiport --destination-ports 3000 -m state --state NEW -j REJECT --reject-with tcp-reset

The result of iptables -L INPUT -n is

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 59100 multiport dports 3000 state NEW reject-with tcp-reset

But it turns out that both of the ports are not rejected when I try to connect from a client.

The version is v1.4.2-rc1.

Is there a workaround, or what should I do when I need to specify more than 15 ports in one rule.

iptables
5 Answers

You need to use multiple rules to implement OR-like semantics, since matches are always AND-ed together within a rule. Alternatively, you can do matching against port-indexing ipsets (ipset create blah bitmap:port).

user_10915870

Only one rule:

sudo iptables -A INPUT -i enp1s0 -p tcp -m multiport --dports 0:8080 -j REJECT

(enp0 is my interface; change this with your interface name)

user_165909970

As far as i know, writing multiple matches is logical AND operation; so what your rule means is if the destination port is "59100" AND "3000" then reject connection with tcp-reset; Workaround is using -mport option. Look out for the man page.

user_13032470
Related