Iptables Drop rule - strange behaviour

[sreejith menon <sreejithjmenon@xxxxxxxxx>]

Hi,

I have the below setup for my firewall and i am using iptables 1.4.9.1 v


Client PC (eth0, 172.31.114.239)--------------(eth0 172.31.114.252)
Firewall Router (eth1, 10.2.2.2)--------------------Network PC
(10.2.2.1)

I have set the default policy as accept for my testing purpose. My aim
is to prevent ssh from Client PC to Network PC. But allow ssh from
Network PC to Client PC.

I have the following iptables rule

iptables -nvL

Chain INPUT (policy ACCEPT 744 packets, 46652 bytes)

 pkts bytes target     prot opt in     out     source               destination

 9989  780K ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0           state RELATED,ESTABLISHED


 Chain FORWARD (policy ACCEPT 3 packets, 180 bytes)

 pkts bytes target     prot opt in     out     source               destination

    82 17854 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0           state RELATED,ESTABLISHED

    11   660 DROP       tcp  --  *      eth1    0.0.0.0/0
0.0.0.0/0           source IP range 172.31.114.1-172.31.114.254 tcp
spts:2:65535 dpt:22 destination IP range 10.2.2.1-10.2.2.254


 Chain OUTPUT (policy ACCEPT 1741 packets, 149K bytes)

 pkts bytes target     prot opt in     out     source               destination
     0     0 DROP       tcp  --  *      eth1    0.0.0.0/0
0.0.0.0/0           source IP range 172.31.114.1-172.31.114.254 tcp
spt:22 dpts:2:65535 destination IP range 10.2.2.1-10.2.2.254

 Observations
 -------------------

1. Ssh from Network PC to client PC  --- ssh successful as expected
2. ssh from client pc to Network PC ---- ssh blocked as expected
3.  Again ssh from Network PC to client PC  --- ssh  blocked which was
not expected.
4. If i randomly insert some rules which has no relevance to ssh, and
do step 1 alone again - ssh sucessful
5.  Again do step 2 followed by step -- ssh blocked ..problem.

 Please help or any idea will be very much appreciated

Also, noted that if i have a ssh rule to deny from client PC to
network PC. If i do ftp, it is fine. But if i do ssh followed by ftp,
ftp doesnt work. please note that default policy is accept all. I did
not add or delete rules in between.


thanks and regards
sreejith
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html