Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I configure hosts.allow and hosts.deny to allow all connections from all hosts except for some hosts/ports specified in hosts.deny?

This is what I have now in these files:





I want to allow all connections except for somehost:someport, but the above configuration does not work.


Well, I found out in this case hosts.allow should be an empty file, but it's still allowing connections on someport...

share|improve this question
The hosts.allow/deny stuff only works for servers linked to tcpwrappers. If you don't know if that's the case for your server, try blocking everything and see if you can still connect. – symcbean Nov 17 '10 at 12:47

You've got it backwards.

It should be like this:

someport : somehost

The syntax is actually more expressive than this: the port and the hosts can be lists, and the port can instead be specified by daemon name instead of port number, for example. Your system ought to have documentation for the format of the file.

And you're right about hosts.allow, it should be empty as the default action is to accept.

share|improve this answer
I now have my hosts.allow file empty and someport:ALL line in hosts.deny - but it still allows connections on someport - I don't know what's wrong now? – user58292 Nov 17 '10 at 12:46
BTW I straced inetd and tcpd opens and reads contents of the hosts.deny file when something tries connecting on someport. – user58292 Nov 17 '10 at 13:00

You can also use the extended format described in hosts_options(5) and use /etc/hosts.allow only.

share|improve this answer
I think this is the best approach. Put ALL:ALL in hosts.deny, and make exceptions in hosts.allow. In this case (allow most everything), that means starting with a really large exception -- but that's okay. – mattdm Nov 17 '10 at 15:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.