We help IT Professionals succeed at work.
Get Started

iptables dropping some ssh packages

723 Views
Last Modified: 2012-05-10
Hello,

I have iptables setup (on a CentOS 3.x server) to allow ssh both in and out of the server.  It seems to be working fine, but in /var/log/messages, I can see that many ssh packages are still dropped.  Before installing the iptables in production, I would like to find out why those ssh packages are dropped and preferably how to fix it.

Here are the rules & chains (with unrelated protocols stripped out), followed by a sample of the log entries:


--- Rules:
      # Incoming rules:
      iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
      iptables -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
      
      iptables -A INPUT -j LOGDROP
      
      # Outgoing rules:
      iptables -I OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
      iptables -A OUTPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
      
      iptables -A OUTPUT -j LOGDROP


--- Chains:
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        
 2799  319K ACCEPT     all  --  any    any     anywhere             anywhere           state RELATED,ESTABLISHED
   45  4320 ACCEPT     all  --  lo     any     anywhere             anywhere          
   21  1300 ACCEPT     tcp  --  any    any     anywhere             anywhere           state NEW tcp dpt:ssh
 1953  277K LOGDROP    all  --  any    any     anywhere             anywhere          

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        
 3088  750K ACCEPT     all  --  any    any     anywhere             anywhere           state RELATED,ESTABLISHED
   45  4320 ACCEPT     all  --  any    lo      anywhere             anywhere          
    1    60 ACCEPT     tcp  --  any    any     anywhere             anywhere           tcp dpt:ssh state NEW
   67  9040 LOGDROP    all  --  any    any     anywhere             anywhere          

Chain LOGDROP (2 references)
 pkts bytes target     prot opt in     out     source               destination        
 1207 72737 LOG        tcp  --  any    any     anywhere             anywhere           limit: avg 2/sec burst 10 LOG level warning prefix `TCP LOGDROP: '
  813  214K LOG        udp  --  any    any     anywhere             anywhere           limit: avg 2/sec burst 10 LOG level warning prefix `UDP LOGDROP: '
    0     0 LOG        icmp --  any    any     anywhere             anywhere           limit: avg 2/sec burst 10 LOG level warning prefix `ICMP LOGDROP: '
    0     0 LOG        all  -f  any    any     anywhere             anywhere           limit: avg 2/sec burst 10 LOG level warning prefix `FRAGMENT LOGDROP: '
 2020  286K DROP       all  --  any    any     anywhere             anywhere          


--- Log entries:
Oct 15 20:00:18 ff-lin4 kernel: TCP LOGDROP: IN= OUT=eth0 SRC=10.1.1.31 DST=10.1.1.21 LEN=116 TOS=0x10 PREC=0x00 TTL=64 ID=34002 DF PROTO=TCP SPT=22 DPT=47518 WINDOW=10880 RES=0x00 ACK PSH URGP=0
Oct 15 20:00:18 ff-lin4 kernel: TCP LOGDROP: IN= OUT=eth0 SRC=10.1.1.31 DST=10.1.1.21 LEN=116 TOS=0x10 PREC=0x00 TTL=64 ID=34003 DF PROTO=TCP SPT=22 DPT=47518 WINDOW=10880 RES=0x00 ACK PSH URGP=0
Oct 15 20:00:19 ff-lin4 kernel: TCP LOGDROP: IN= OUT=eth0 SRC=10.1.1.31 DST=10.1.1.21 LEN=116 TOS=0x10 PREC=0x00 TTL=64 ID=34004 DF PROTO=TCP SPT=22 DPT=47518 WINDOW=10880 RES=0x00 ACK PSH URGP=0
Oct 15 20:00:20 ff-lin4 kernel: TCP LOGDROP: IN= OUT=eth0 SRC=10.1.1.31 DST=10.1.1.21 LEN=116 TOS=0x10 PREC=0x00 TTL=64 ID=34005 DF PROTO=TCP SPT=22 DPT=47518 WINDOW=10880 RES=0x00 ACK PSH URGP=0

Any help on this much appreciated.

Thanks,
lbj
Comment
Watch Question
This problem has been solved!
Unlock 2 Answers and 2 Comments.
See Answers
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE