Can someone please help me to understand why we should set ssh iptables INPUT rule destination port instead of source port? why SSH - iptables -A INPUT -p tcp -s tunnel_1_private_IP --dport 22 -i eth1 -j ACCEPT
not iptables -A INPUT -p tcp -s tunnel_1_private_IP --sport 22 -i eth1 -j ACCEPT
because for http or https, we set: iptables -A INPUT -p tcp -s <some-ip-address> --sport 80 -j ACCEPT
not iptables -A INPUT -p tcp -s <some-ip-address> --dport 80 -j ACCEPT
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Accepted Answer
INPUT is a chain that deals with incoming requests. So you have to shift your perspective to that of someone on the receiving end - the SSH server. I get an external packet from SRC_IP_A, SRC_PORT_A to connect to me at DST_IP_B, DST_PORT_B. So when you have this INPUT rule:
SSH - iptables -A INPUT -p tcp -s tunnel1private_IP --dport 22 -i eth1 -j ACCEPT
You care about where this packet is coming, which is SRC_IP_A (tunnel1private_IP) and what port it wants to connect to DST_PORT_B (22).
Why would you care about the SRC_PORT_A at all? SRC_PORT_A is a random non-privileged port used by the SSH client to initiate communication with the DST_PORT_B - the SSH server.
Once you shift your mind perspective and get some practice with it, it’ll start clicking.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and AI-native businesses
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.