Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port?


share|improve this question
up vote 38 down vote accepted

One liner:

iptables -I INPUT \! --src -m tcp -p tcp --dport 777 -j DROP  # if it's not, drop it

A more elegant solution:

iptables -N xxx # create a new chain
iptables -A xxx --src -j ACCEPT  # allow
iptables -A xxx --src -j ACCEPT  # allow
iptables -A xxx --src -j ACCEPT  # allow
iptables -A xxx -j DROP  # drop everyone else
iptables -I INPUT -m tcp -p tcp --dport 777 -j xxx  # use chain xxx for packets coming to TCP port 777
share|improve this answer
Do you know if I should also add this to the OUTPUT also? – Anonymous12345 May 30 '10 at 12:05
@Camran: you need to be more specific. In this particular case, if you replace INPUT with OUTPUT you would block some packets sent using some addresses of the server itself (and not routed/forwarded). I doubt this makes sense, unless maybe you want to block programs that bind to some specific interfaces. – Cristian Ciupitu May 17 '11 at 20:15
Don't forget you can also specify your sources in a chain like: --src – deed02392 Jan 2 '13 at 20:01
How would I later add a new allowed IP to the chain? Would I have to remove the DROP first, then enter the new user and insert the DROP again or is there a better solution? – maddo7 Jun 3 '15 at 20:15
@Matthias: iptables -I xxx --src -j ACCEPT – Cristian Ciupitu Jun 3 '15 at 20:17

Here's an example from one of my CentOS systems (addresses have been obfuscated):

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s -d --dport 22 -j ACCEPT
share|improve this answer
on centos, where to make this configuration permanent? (in ubuntu, we can use /etc/network/if-up.d/anyfile) – Kokizzu Mar 18 '13 at 1:45
on CentOS it is: service iptables save. – syslogic Jun 1 '15 at 23:37

I use shorewall to configure IP table. Use a rule like to accept from one host to port 123.

ACCEPT net: $FW tcp 1234

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.