Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to close certain TCP/UDP ports (incoming) for ALL networks except listed through IPTABLES.

I have a small set of NETWORKS I'd like to leave THE ports to be open. But want to close for all other networks.

Thank you!

share|improve this question
Can you please clarify your question? You can give an example if possible. – Khaled Nov 25 '10 at 8:17
up vote 0 down vote accepted

Simply put an ACCEPT rule before you DROP/REJECT. For example

iptables -A INPUT -s -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

will allow connection to TCP port 80 from network while dropping all other connections to the port.

share|improve this answer
// , If there are existing TCP connections on the DROPped ports, though, will this drop them? – Nathan Basanese yesterday

Set accept rules for all of the traffic that you want to allow through and then have a deny rule for everything else.

iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited

Allows traffic to port 80 and rejects everything else.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.