Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 11 down vote favorite
11

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port?

Thanks

share|improve this question

3 Answers

up vote 18 down vote accepted

One liner:

iptables -I INPUT \! --src 1.2.3.4 -m tcp -p tcp --dport 777 -j DROP  # if it's not 1.2.3.4, drop it

A more elegant solution:

iptables -N xxx # create a new chain
iptables -A xxx --src 1.2.3.4 -j ACCEPT  # allow 1.2.3.4
iptables -A xxx --src 1.2.3.5 -j ACCEPT  # allow 1.2.3.5
iptables -A xxx --src 1.2.3.6 -j ACCEPT  # allow 1.2.3.6
iptables -A xxx -j DROP  # drop everyone else
iptables -I INPUT -m tcp -p tcp --dport 777 -j xxx  # use chain xxx for packets coming to TCP port 777
share|improve this answer
Do you know if I should also add this to the OUTPUT also? – Anonymous12345 May 30 '10 at 12:05
@Camran: you need to be more specific. In this particular case, if you replace INPUT with OUTPUT you would block some packets sent using some addresses of the server itself (and not routed/forwarded). I doubt this makes sense, unless maybe you want to block programs that bind to some specific interfaces. – Cristian Ciupitu May 17 '11 at 20:15
1  
Don't forget you can also specify your sources in a chain like: --src 1.2.3.4/30 – deed02392 Jan 2 at 20:01
up vote 0 down vote

Here's an example from one of my CentOS systems (addresses have been obfuscated):

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 1.2.3.4 -d 5.6.7.8 --dport 22 -j ACCEPT
share|improve this answer
on centos, where to make this configuration permanent? (in ubuntu, we can use /etc/network/if-up.d/anyfile) – Kiswono Prayogo Mar 18 at 1:45
up vote 0 down vote

I use shorewall to configure IP table. Use a rule like to accept from one host to port 123.

ACCEPT net:192.0.2.1 $FW tcp 1234

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.