Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to setup my new server (located on my LAN) to ALLOW ALL incoming and outgoing traffic from any other computer on my LAN, but DENY any connections from systems outside of the LAN. My question is how do I setup iptables to do this ?

Also,I would like to know if this would impact my ability to download files from the Internet on that server ? Would I still be able to download security updates for the server if I set things up this way ? As you may have guessed I am pretty new to all of this so please excuse my ignorance in advance.

Thanks, Tim

share|improve this question

Suppose your LAN is Run

sudo ufw enable
sudo ufw allow from

It seems that that by default ufw allows outbound so this would not affect your ability to download files from the Internet. After these commands are executed run sudo iptables -L -v -n and post the output and I'll tell you for certain.

See and for more info.

share|improve this answer
I cannot post the entire output here because it is to large to include as a comment so I copied and pasted it to this pastebin link. To be honest, I do not have a clue what I am looking at or know if this is correct, but I did follow your instructions and this is what I ended up with. – user63149 Dec 9 '10 at 21:11
@Tim. Wow that is complicated. From what I can tell, though, your 2 goals are accomplished. However, is your LAN actually I was using that as an example. Also, have you attempted to make an outgoing connection to the Internet from the server? – Mark Wagner Dec 10 '10 at 0:30
My LAN IPs actually start at and I put that IP in the firewall rule you listed and it shows up like that when I check the rule using this command sudo ufw status . However, in pastebin file the IP is shown differently so I am not sure which one is is actually working or if it's working at all. I am pretty sure what I am trying to do is a common task, but the lack of official documentation on the subject makes it quite difficult to implement. – user63149 Dec 10 '10 at 2:09
@Tim In a simple network is in the subnet so I'm guessing it was converted to that. The links in my answer are the official documentation. When in doubt experiment. – Mark Wagner Dec 10 '10 at 17:42

Install Shorewall with the single interface example. This can be handled with the policy file.

share|improve this answer

Using IPtables are always best way to secure your server besides that you can also use TCP wrappers. As example in order to allow/deny access to ALL tcpwrappers services to ALL clients:


The above configuration on /etc/hosts.deny will deny access to all tcpwrappers services. However this line on /etc/hosts.allow will allow access to all tcpwrappers services with no restrictions. In order to deny sshd access from the IP the following configuration can be used on /etc/hosts.deny :

sshd : 

Specifically, in your case you can modify /etc/hosts.allow :


I assume your LAN network is in this case. ALL in hosts.allow allows all services provided by the server. Next you need to modify /etc/hosts.deny:

ALL: Deny

I usually use iptables and tcpwrappers altogether for maximum security on per machine level.

share|improve this answer

Use a firewall, linux has Iptables built in:

Since it's pretty complex, I'd use a tool like GuardDog (KDE) to set it up.

share|improve this answer
I know I need a firewall and already have iptables. I just need to set it up correct which is why I asked here. Also, I do use a graphics enabled server (or w/e you call it) everything is command line only so installing an applik the guard dog app would be useless for me. Finally, I using Ubuntu 10.04-1 as the server and do only intend to have a few servers (mainly SSH, FTP, Webmin) installed so I do not need to worry about setting stuff up for Apache, Mysql, Php,... Just the basics. – user63149 Dec 9 '10 at 20:09
Furthermore, my entire network is behind a NAT router (which has it's own firewall) so do I even need to worry about setting up the linux firewall in the first place if I do not explicit allow ports to be forwarded in my routers firewall ? – user63149 Dec 9 '10 at 20:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.