iptables: block specific port by country

Question

to block by country for a specific port?

Is it just a matter of changing this:

# Drop everything
$IPT -I INPUT -j $SPAMLIST
$IPT -I OUTPUT -j $SPAMLIST
$IPT -I FORWARD -j $SPAMLIST

to:

# Drop everything
$IPT -I INPUT --dport XXX -j $SPAMLIST
$IPT -I OUTPUT --dport XXX  -j $SPAMLIST
$IPT -I FORWARD --dport XXX  -j $SPAMLIST

alvosu · Answer 1 · 2011-01-30 16:57:28Z

up vote 1 down vote accepted

You need add protocol(tcp or udp), for tcp:

$IPT -I INPUT -p tcp --dport XXX -j $SPAMLIST
$IPT -I OUTPUT -p tcp --dport XXX  -j $SPAMLIST
$IPT -I FORWARD -p tcp --dport XXX  -j $SPAMLIST

or(for udp):

$IPT -I INPUT -p udp --dport XXX -j $SPAMLIST
$IPT -I OUTPUT -p udp --dport XXX  -j $SPAMLIST
$IPT -I FORWARD -p udp --dport XXX  -j $SPAMLIST

must be replaced dport to sport in OUTPUT chain.

answered Jan 30 '11 at 16:51

alvosu
4,53739

	ahhhhhhhhh right. Is there any point of blocking UDP as well? or rather can I combine them into one line? I assume the answers to that are yes, and no. – Edward Jan 30 '11 at 17:10
	Omitting the `-p tcp` option will block all protocols. If you don't have the port open for upd it doesn't help, but won't cost much. I don't know how the port will map to ICMP protocol so you my want to match the protocol using `-p !icmp` to match any protocol other than ICMP – BillThor Jan 30 '11 at 20:08

feedback

1 Answer