Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When building a new system I do not turn on the network until I have configured iptables to prevent all inbound traffic except on port 22 (ssh). Later, I open up ports and configure allowed address ranges.

What is the shortest iptables command I can type to disallow all inbound traffic except connections to port 22 from a (given) single IP address?

share|improve this question

3 Answers 3

up vote 1 down vote accepted
# flush rules 
iptables -F INPUT
iptables -P INPUT DROP
# allow loopback traffic
iptables -A INPUT -s lo -j ACCEPT
# allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# allow ssh
iptables -A INPUT -s 10.15.10.0/24 -p tcp --dport 22 -j ACCEPT
share|improve this answer

I'm not great on the actual commands, but my iptables file would look like this:

#Filter all previous rules

*filter

# Loopback address

-A INPUT -i lo -j ACCEPT

# Established inbound rule for eth+ connections

-A INPUT -i eth+ -m state --state RELATED,ESTABLISHED -j ACCEPT

# Allow ssh access

-A INPUT -i eth+ -s X.X.X.X/Y -p tcp --dport 22 -j ACCEPT

# Explicit rules at the end

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT ACCEPT [0:0]

COMMIT

share|improve this answer

iptables -F
iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp -j DROP

Very similar to @pQd (vote him up not me), but I hate DROP policies - I think they're bad practice.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.