Wichita's largest indoor sports and adventure facility. Trampolines, basketball, volleyball, parties and events all under one roof.
First give a -p option like -p tcp or -p udp. Examples: iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j DROP iptables -A INPUT -p udp --dport 53 --sport 1024:65535 -j ACCEPT You could also try -p all but I've never done that and don't find too much support for it in the examples.
Also mind the spaces between parenthesis): ss --kill -tn 'dst == 192.0.2.2 and ( sport == 80 or sport == 443 )' (or just the destination, it's about an attacker anyway). Unlike tcpkill this doesn't involve sending custom packets anywhere, it's directly done to the socket using a kernel API.
-A OUTPUT -p tcp -m tcp --sport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT Because your OUTPUT rules block output packets to non-allowed ports, it's allow only access to port 8080.
with "u32 match ip sport 80" in Linux tc I can match port 80, but how can I match a port range 10000 - 20000 ?