Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to linux server. I'm currently trying to get an Ubuntu 10.10 server up and running for the first time and I'm using Webmin for administration. I'm stuck on the setting up the firewall. What I need to do is to ONLY allow a range of IPs (e.g - to access the HTTP server and Webmin. I've seen a lot of tutorials but none of them fits what I needed.

Thanks in advance!

share|improve this question
up vote 3 down vote accepted

You can use the following commands to allow access to HTTP server given that you have default policy set to DROP for INPUT and OUTPUT chains.

$ sudo iptables -A INPUT -i lo -j ACCEPT
$ sudo iptables -A OUTOUT -i lo -j ACCEPT
$ sudo iptables -A INPUT -s -p tcp -m tcp --dport 80 -j ACCEPT
$ sudo iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

$ sudo iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
$ sudo iptables -A INPUT  -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
$ sudo iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

All subnet will be allowed to access your web server. You can customize it according to your needs.

Be careful, uou may need to allow other protocols such as SSH (port 22) to be able to access the server remotely.

EDIT: The last four rules added to allow the server to request DNS and HTTP.

share|improve this answer
Thanks for the reply. Since you said that this commands only allow access to the webserver (port 80), how bout the commands to give access to subnet to ALL the ports instead? Thanks again. – eggman20 Dec 22 '10 at 10:23
You can just remove the --dport 80 and --sport 80 from the last two commands. – Khaled Dec 22 '10 at 10:34
I tried it and worked perfectly. Thanks much. – eggman20 Dec 23 '10 at 4:22
Sorry, one more thing, would this allow the server to get an update? I tried updating the server and it couldn't resolve any site. I get an error "Temporary failure ''". Would rules blocked any updates on my server? Thanks again. – eggman20 Dec 24 '10 at 0:13
@eggman20: You can check the answer again. I added the necessary rules. – Khaled Dec 24 '10 at 8:00

If you find iptables too cryptic, Ubuntu has a simple iptables wrapper called ufw.

share|improve this answer
You may need to provide an example to get him started :) – Khaled Dec 24 '10 at 17:10
The link in my answer points to the HOWTO, which has examples for both a default DENY policy and an ALLOW rule for a certain IP. Stating that "I've seen a lot of tutorials but none of them fits what I needed" without providing any examples of rulesets that don't work triggers suspicions. I don't want the eventual example from my answer to become "one more tutorial that doesn't fit", but I'm sure that if the OP will post a ruleset for ufw that doesn't work for him, other SF readers will be able to tell him what's wrong with them. – halp Dec 25 '10 at 9:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.