Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When building a new system I do not turn on the network until I have configured iptables to prevent all inbound traffic except on port 22 (ssh). Later, I open up ports and configure allowed address ranges.

What is the shortest iptables command I can type to disallow all inbound traffic except connections to port 22 from a (given) single IP address?

share|improve this question
up vote 1 down vote accepted
# flush rules 
iptables -F INPUT
iptables -P INPUT DROP
# allow loopback traffic
iptables -A INPUT -s lo -j ACCEPT
# allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# allow ssh
iptables -A INPUT -s -p tcp --dport 22 -j ACCEPT
share|improve this answer

I'm not great on the actual commands, but my iptables file would look like this:

#Filter all previous rules


# Loopback address

-A INPUT -i lo -j ACCEPT

# Established inbound rule for eth+ connections

-A INPUT -i eth+ -m state --state RELATED,ESTABLISHED -j ACCEPT

# Allow ssh access

-A INPUT -i eth+ -s X.X.X.X/Y -p tcp --dport 22 -j ACCEPT

# Explicit rules at the end





share|improve this answer

iptables -F
iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp -j DROP

Very similar to @pQd (vote him up not me), but I hate DROP policies - I think they're bad practice.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.