Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How could I modify this script:

to block by country for a specific port?

Is it just a matter of changing this:

# Drop everything


# Drop everything
share|improve this question
up vote 1 down vote accepted

You need add protocol(tcp or udp), for tcp:

$IPT -I INPUT -p tcp --dport XXX -j $SPAMLIST
$IPT -I OUTPUT -p tcp --dport XXX  -j $SPAMLIST
$IPT -I FORWARD -p tcp --dport XXX  -j $SPAMLIST

or(for udp):

$IPT -I INPUT -p udp --dport XXX -j $SPAMLIST
$IPT -I OUTPUT -p udp --dport XXX  -j $SPAMLIST
$IPT -I FORWARD -p udp --dport XXX  -j $SPAMLIST

must be replaced dport to sport in OUTPUT chain.

share|improve this answer
ahhhhhhhhh right. Is there any point of blocking UDP as well? or rather can I combine them into one line? I assume the answers to that are yes, and no. – Edward Jan 30 '11 at 17:10
Omitting the -p tcp option will block all protocols. If you don't have the port open for upd it doesn't help, but won't cost much. I don't know how the port will map to ICMP protocol so you my want to match the protocol using -p !icmp to match any protocol other than ICMP – BillThor Jan 30 '11 at 20:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.