0

I'm trying to allow access to certain ports on the server, via only one of the server IP addresses.

So for example if the server has two IP addresses: 1.1.1.1 1.1.1.2

I only want for example ports 25, 26 to be accessible via 1.1.1.2. I'm not trying to prevent any external IP addresses from accessing the ports, just trying to make sure that they can only access the ports on a certain IP address on the server.

I've been trying to write this using iptables, but I've so far been unsuccessful - I was wondering if anyone could help?

3
  • 1
    Show us that you've tried. iptables is the right tool - what have you tried with it? Dec 18, 2013 at 12:46
  • 1
    Note that showing us only lines starting with iptables -[AI] is basically useless, because iptables rules are position-depdendent. We need to see the output of iptables -L -n -v to have any hope of commenting usefully.
    – MadHatter
    Dec 18, 2013 at 12:57
  • Agreed. I should have mentioned that in my answer.
    – Lawrence
    Dec 18, 2013 at 12:58

1 Answer 1

0

Assuming you have no existing rules for those 2 ports or any blanket accept rules, then these lines below are a good example.

These 2 lines will block access to port 25 and 26 on port 1.1.1.1. Assuming that the default policy is to accept packets.

iptables -A INPUT -p tcp --dport 25 -d 1.1.1.1 -j REJECT
iptables -A INPUT -p tcp --dport 26 -d 1.1.1.1 -j REJECT

Normally though, I would have the default policy on reject or drop and then explicitly allow the 2 ports on the second IP address.

iptables -P INPUT REJECT
iptables -A INPUT -p tcp --dport 25 -d 1.1.1.2 -j ACCEPT
iptables -A INPUT -p tcp --dport 26 -d 1.1.1.2 -j ACCEPT
2
  • Yeah, thats similar the solution I had but I was a little off with the ordering of the statements. Would the following work: iptables -P INPUT -p tcp --dport 25 INPUT REJECT iptables -P INPUT -p tcp --dport 26 INPUT REJECT iptables -A INPUT -p tcp --dport 25 -d 1.1.1.2 -j ACCEPT iptables -A INPUT -p tcp --dport 26 -d 1.1.1.2 -j ACCEPT
    – jdawg
    Dec 18, 2013 at 13:22
  • No, as it would reject anything that hits port 25 and port 26 regardless of which IP address it hits.
    – Lawrence
    Dec 18, 2013 at 13:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .