Linux Iptables block remote X Window server connection

Posted on in Categories Iptables, Linux, Security, X server last updated October 29, 2007

It is true that connections to remote X Window servers should be always made over SSH. SSH supports X windows connections. So my task was allow X over ssh but block unprivileged X windows mangers TCP ports.

The first running server (or display) use TCP port 6000. Next server will use 6001 and so on upto 6063 (max 64 X managers are allowed from 6000-6063).

So assuming that you are going to force user to use ssh for remote connections, here are rules for IPTABLES (add to your firewall script):

iptables -A OUTPUT -o eth0 -p tcp --syn --destination-port 6000:6063 -j REJECT
iptables -A INPUT -i eth0 -p tcp --syn --destination-port 6000:6063 -j DROP

a) The first rules blocks outgoing connection attempt to remove X windows manger.

b) The second rule block incoming request for X windows manger. By using –syn flag you are blocking only connection establishments to the server port.

This is the good way to disallow unprivileged X windows mangers – TCP 6000:6063 ports :)

See also:

Iptables allow CIPE connection request

Posted on in Categories Iptables, Linux, Networking, Security, Troubleshooting last updated January 9, 2008

From my mail bag:

How do I accept CIPE connection requests coming from the outside?

CIPE stands for Crypto IP Encapsulation (see howto Establishing a CIPE Connection) . It is used to configure an IP tunneling device. For example, CIPE can be used to grant access from the outside world into a Virtual Private Network (VPN). All you need to find out CIPE number, once you got the number (device name) append following two IPTABLE rules (add rule to your iptables script) to script:

Iptables rules:

Add the following rules to your iptables script or configuration file:

iptables -A INPUT -p udp -i cipcb0 -j ACCEPT
iptables -A OUTPUT -p udp -o cipcb0 -j ACCEPT

CIPE use its own virtual device. It is use to transmit UDP packets so the above rule allows the cipcb0 interface to incoming request (no need to use eth0).

Replace cipcb0 with your actual device name.