Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port?


share|improve this question

3 Answers 3

up vote 28 down vote accepted

One liner:

iptables -I INPUT \! --src -m tcp -p tcp --dport 777 -j DROP  # if it's not, drop it

A more elegant solution:

iptables -N xxx # create a new chain
iptables -A xxx --src -j ACCEPT  # allow
iptables -A xxx --src -j ACCEPT  # allow
iptables -A xxx --src -j ACCEPT  # allow
iptables -A xxx -j DROP  # drop everyone else
iptables -I INPUT -m tcp -p tcp --dport 777 -j xxx  # use chain xxx for packets coming to TCP port 777
share|improve this answer
Do you know if I should also add this to the OUTPUT also? –  Anonymous12345 May 30 '10 at 12:05
@Camran: you need to be more specific. In this particular case, if you replace INPUT with OUTPUT you would block some packets sent using some addresses of the server itself (and not routed/forwarded). I doubt this makes sense, unless maybe you want to block programs that bind to some specific interfaces. –  Cristian Ciupitu May 17 '11 at 20:15
Don't forget you can also specify your sources in a chain like: --src –  deed02392 Jan 2 '13 at 20:01

I use shorewall to configure IP table. Use a rule like to accept from one host to port 123.

ACCEPT net: $FW tcp 1234

share|improve this answer

Here's an example from one of my CentOS systems (addresses have been obfuscated):

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s -d --dport 22 -j ACCEPT
share|improve this answer
on centos, where to make this configuration permanent? (in ubuntu, we can use /etc/network/if-up.d/anyfile) –  Kokizzu Mar 18 '13 at 1:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.