Keep Established Return Traffic for SSH's Outgoing SOCKS Connections

If SOCKS browsing breaks after the SSH server's firewall changes, do not judge the whole route by the surviving SSH shell. The server opens separate destination TCP connections for dynamic forwarding.

Their replies arrive at server-selected ephemeral ports. A policy allowing new inbound traffic only to the SSH service can drop those packets unless established traffic is accepted.

In an existing IPv4 iptables ruleset, the connection-state fragment is:

-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Place it before a matching terminal drop/reject. It admits tracked return traffic, rather than every new connection to a high port.

Use the dropped tuple and state to verify this cause. OUTPUT must permit the onward connection, and IPv6 paths need their applicable rules. SOCKS negotiation, SSH transport and destination traffic are separate stages to inspect.