Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm new to linux server. I'm currently trying to get an Ubuntu 10.10 server up and running for the first time and I'm using Webmin for administration. I'm stuck on the setting up the firewall. What I need to do is to ONLY allow a range of IPs (e.g 128.171.21.1 - 128.171.21.100) to access the HTTP server and Webmin. I've seen a lot of tutorials but none of them fits what I needed.

Thanks in advance!

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

You can use the following commands to allow access to HTTP server given that you have default policy set to DROP for INPUT and OUTPUT chains.

$ sudo iptables -A INPUT -i lo -j ACCEPT
$ sudo iptables -A OUTOUT -i lo -j ACCEPT
$ sudo iptables -A INPUT -s 128.171.21.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
$ sudo iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

$ sudo iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
$ sudo iptables -A INPUT  -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
$ sudo iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

All subnet 128.171.21.0/24 will be allowed to access your web server. You can customize it according to your needs.

Be careful, uou may need to allow other protocols such as SSH (port 22) to be able to access the server remotely.

EDIT: The last four rules added to allow the server to request DNS and HTTP.

share|improve this answer
    
Thanks for the reply. Since you said that this commands only allow access to the webserver (port 80), how bout the commands to give access to 128.171.21.0/24 subnet to ALL the ports instead? Thanks again. –  eggman20 Dec 22 '10 at 10:23
    
You can just remove the --dport 80 and --sport 80 from the last two commands. –  Khaled Dec 22 '10 at 10:34
    
I tried it and worked perfectly. Thanks much. –  eggman20 Dec 23 '10 at 4:22
    
Sorry, one more thing, would this allow the server to get an update? I tried updating the server and it couldn't resolve any site. I get an error "Temporary failure 'us.archive.ubuntu.com'". Would rules blocked any updates on my server? Thanks again. –  eggman20 Dec 24 '10 at 0:13
    
@eggman20: You can check the answer again. I added the necessary rules. –  Khaled Dec 24 '10 at 8:00
show 1 more comment

If you find iptables too cryptic, Ubuntu has a simple iptables wrapper called ufw.

share|improve this answer
    
You may need to provide an example to get him started :) –  Khaled Dec 24 '10 at 17:10
    
The link in my answer points to the HOWTO, which has examples for both a default DENY policy and an ALLOW rule for a certain IP. Stating that "I've seen a lot of tutorials but none of them fits what I needed" without providing any examples of rulesets that don't work triggers suspicions. I don't want the eventual example from my answer to become "one more tutorial that doesn't fit", but I'm sure that if the OP will post a ruleset for ufw that doesn't work for him, other SF readers will be able to tell him what's wrong with them. –  halp Dec 25 '10 at 9:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.