Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How could I modify this script: http://www.cyberciti.biz/faq/block-entier-country-using-iptables/

to block by country for a specific port?

Is it just a matter of changing this:

# Drop everything
$IPT -I INPUT -j $SPAMLIST
$IPT -I OUTPUT -j $SPAMLIST
$IPT -I FORWARD -j $SPAMLIST

to:

# Drop everything
$IPT -I INPUT --dport XXX -j $SPAMLIST
$IPT -I OUTPUT --dport XXX  -j $SPAMLIST
$IPT -I FORWARD --dport XXX  -j $SPAMLIST
share|improve this question

1 Answer 1

up vote 1 down vote accepted

You need add protocol(tcp or udp), for tcp:

$IPT -I INPUT -p tcp --dport XXX -j $SPAMLIST
$IPT -I OUTPUT -p tcp --dport XXX  -j $SPAMLIST
$IPT -I FORWARD -p tcp --dport XXX  -j $SPAMLIST

or(for udp):

$IPT -I INPUT -p udp --dport XXX -j $SPAMLIST
$IPT -I OUTPUT -p udp --dport XXX  -j $SPAMLIST
$IPT -I FORWARD -p udp --dport XXX  -j $SPAMLIST

must be replaced dport to sport in OUTPUT chain.

share|improve this answer
    
ahhhhhhhhh right. Is there any point of blocking UDP as well? or rather can I combine them into one line? I assume the answers to that are yes, and no. –  Edward Jan 30 '11 at 17:10
    
Omitting the -p tcp option will block all protocols. If you don't have the port open for upd it doesn't help, but won't cost much. I don't know how the port will map to ICMP protocol so you my want to match the protocol using -p !icmp to match any protocol other than ICMP –  BillThor Jan 30 '11 at 20:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.