Iptables setting multiple multiports in one rule

Question

The multiport extension has a limit (15) for the ports that can be specified.

But I need to specify much more port numbers in a single rule, so I tried to use several multiport in one rule like:

iptables -A INPUT -p tcp -m multiport --destination-ports 59100 -m multiport --destination-ports 3000 -m state --state NEW -j REJECT --reject-with tcp-reset

The result of iptables -L INPUT -n is

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 59100 multiport dports 3000 state NEW reject-with tcp-reset

But it turns out that both of the ports are not rejected when I try to connect from a client.

The version is v1.4.2-rc1.

Is there a workaround, or what should I do when I need to specify more than 15 ports in one rule.

score 39 · Answer 1 · edited Oct 11 '12 at 18:06

39

As a workaround to this limitation, I use two rules to cover all the cases.

For example, if I want to allow or deny these 18 ports:

465,110,995,587,143,11025,20,21,22,26,80,443,3000,10000,7080,8080,3000,5666

I use the below rules:

iptables -A INPUT -p tcp -i eth0 -m multiport --dports 465,110,995,587,143,11025,20,21,22,26,80,443 -j ACCEPT

iptables -A INPUT -p tcp -i eth0 -m multiport --dports 3000,10000,7080,8080,3000,5666 -j ACCEPT

The above rules should work for your scenario also. You can create another rule if you hit 15 ports limit on both first and second rule.

edited Oct 11 '12 at 18:06

Andrew Barber

39,603
20
94
123

answered Jul 03 '12 at 06:43

vinod garag

391
3
3

2

You can also add a range: `--dports 20:11025` (which would not be the favoureable solution in your case). is it possible to mix ranges and single ports in that list like `20:26,80,143,110,443:465,995,587,3000,7080,8080,5666,10000,11025`? see also: http://serverfault.com/a/751074/128892 – rubo77 Mar 09 '16 at 08:19

score 4 · Answer 2 · answered Mar 30 '12 at 16:46

4

You need to use multiple rules to implement OR-like semantics, since matches are always AND-ed together within a rule. Alternatively, you can do matching against port-indexing ipsets (ipset create blah bitmap:port).

answered Mar 30 '12 at 16:46

jørgensen

10,149
2
20
27

score 2 · Answer 3 · edited Sep 06 '22 at 13:21

2

Only one rule:

sudo iptables -A INPUT -i enp1s0 -p tcp -m multiport --dports 0:8080 -j REJECT

(enp0 is my interface; change this with your interface name)

edited Sep 06 '22 at 13:21

Daniel Andrzejewski

470
4
10

answered Aug 04 '21 at 07:51

Koosha Yeganeh

65
5

1

with -m multiport is --dports, with s – Adriano G. V. Esposito Jul 07 '22 at 15:40

score 0 · Answer 4 · answered Mar 30 '12 at 12:32

0

As far as i know, writing multiple matches is logical AND operation; so what your rule means is if the destination port is "59100" AND "3000" then reject connection with tcp-reset; Workaround is using -mport option. Look out for the man page.

answered Mar 30 '12 at 12:32

neoinzion

11

score -5 · Answer 5 · edited Oct 04 '12 at 23:01

enable_boxi_poorten

}

enable_boxi_poorten() {
SRV="boxi_poorten"
boxi_ports="427 5666 6001 6002 6003 6004 6005 6400 6410 8080 9321 15191 16447 17284 17723 17736 21306 25146 26632 27657 27683 28925 41583 45637 47648 49633 52551 53166 56392 56599 56911 59115 59898 60163 63512 6352 25834"


case "$1" in
  "LOCAL")
         for port in $boxi_ports; do $IPT -A tcp_inbound -p TCP -s $LOC_SUB --dport $port -j ACCEPT -m comment --comment "boxi specifieke poorten";done
     # multiports gaat maar tot 15 maximaal :((
     # daarom maar for loop maken
     # $IPT -A tcp_inbound -p TCP -s $LOC_SUB -m state --state NEW -m multiport --dports $MULTIPORTS -j ACCEPT -m comment --comment "boxi specifieke poorten"
     echo "${GREEN}Allowing $SRV for local hosts.....${NORMAL}"
    ;;
  "WEB")
     for port in $boxi_ports; do $IPT -A tcp_inbound -p TCP -s 0/0 --dport $port -j ACCEPT -m comment --comment "boxi specifieke poorten";done
     echo "${RED}Allowing $SRV for all hosts.....${NORMAL}"
    ;;
  *)
     for port in $boxi_ports; do $IPT -A tcp_inbound -p TCP -s $LOC_SUB --dport $port -j ACCEPT -m comment --comment "boxi specifieke poorten";done
     echo "${GREEN}Allowing $SRV for local hosts.....${NORMAL}"
    ;;
 esac

}

You should at least left some comments on what your code does and avoid writing comments in another language than english. — akluth, Oct 05 '12 at 13:18
I don't know Dutch, but I understand some comments: "multiports goes to 15 max." and "that's why we make this loop". — nalply, Oct 08 '13 at 11:50

Iptables setting multiple multiports in one rule

5 Answers5