Just to confirm, if I do not use state connections, and use static instead i.e: /sbin/iptables -A INPUT -p tcp -i eth0 --dport 22 \ --sport 1024:65535 -j ACCEPT /sbin/iptables -A OUTPUT -p tcp -o eth0 --sport 22 \ --dport 1024:65535 -j ACCEPT It works perfectly. Mark