title: How to allow only tunneled connections to port?
body: <p>I'd like to make a git-daemon go through a permanent ssh tunnel. I accomplished this task. How do I block any remote untunneled connection to the GIT_DAEMON port (9418 in my case)?</p>
  
  <p>I already tried simple rules in iptables (block everything except localhost):</p>
  
  <pre><code>$ iptables -A INPUT -p tcp -d ! localhost --destination-port 9418 -j DROP
  </code></pre>
  
  <p>But it also blocks a tunnel (since it saves source ip address). If I have one more host for firewall it can be simply done by blocking any remote connection to this port, but I need this host to do this job.</p>
  
  <p>The tunnel is created in one of two ways:</p>
  
  <p>For Windows:</p>
  
  <pre><code>plink.exe -N -i &lt;key&gt; -L 127.0.0.1:9418:192.168.1.69:9418 tunnel@192.168.1.69
  </code></pre>
  
  <p>For Linux:</p>
  
  <pre><code>ssh -N -i &lt;key&gt; -L 127.0.0.1:9418:192.168.1.69:9418 tunnel@192.168.1.69
  </code></pre>