Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have struggled throughout the years to get a solid understanding on iptables. Any time I try and read through the man pages my eyes start to glaze over.

I have a service that I only want to allow the localhost to have access to.

What terms (or configuration, if someone is feeling generous) should I Google for to allow only localhost host to have access to a given port?

share|improve this question
    
What port is this service running on? –  Bart De Vos Mar 14 '11 at 14:44
    
44344, its a service written in-house –  iptablessuck Mar 14 '11 at 14:46
    
I would like to change my nick temporarily for 'iptablesrules' but I can't –  Art Shayderov Mar 14 '11 at 14:47
    
@Art, they only suck because I dont understand them :) –  iptablessuck Mar 14 '11 at 14:48
    
@iptablessuck actually it looks like I can. But I won't cause I'm not sure I will be able to change it back :) –  Art Shayderov Mar 14 '11 at 14:53

2 Answers 2

up vote 15 down vote accepted

If by service you mean a specific port, then the following two lines should work. Change the "25" to whatever port you're trying to restrict.

iptables -A INPUT -p tcp -s localhost --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP
share|improve this answer
    
"Anything coming from localhost to port 25, accept" and the second rule says "Drop anything coming into port 25". The first line is processed first, allowing localhost, and anything else will get dropped by the second line. Yes? –  iptablessuck Mar 14 '11 at 14:49
    
That's correct! –  Hyppy Mar 14 '11 at 14:51
    
TCP should be in lowercase, there... –  pepoluan Mar 14 '11 at 16:45
1  
@Hyppy, how would you "undo" this? –  tester Aug 17 '13 at 2:28
2  
@tester type those commands again, but replace -A with -D –  pepoluan Aug 25 '13 at 17:14

I'd recommend:

iptables -A INPUT -i lo -p tcp --dport $APP_PORT -j ACCEPT
iptables -A INPUT -p tcp --dport $APP_PORT -j DROP

Because, self-addressed packets do not necessarily have 127.0.0.1 as its source, but they all 'enter' from the lo interface.

Now, if you really want to understand iptables the first thing you should do is to download and print good diagrams explaining the relations of the netfilter tables. Here are two great ones:

Finally, read a lot of iptables HOWTO's. The practical examples would help you get up-to-speed real quick :)

share|improve this answer
    
ty! lo shows up for me after using these commands with the last command from this link cyberciti.biz/faq/howto-display-linux-iptables-loaded-rules iptables -L -v -n --line-numbers –  user144330 Aug 25 '13 at 3:01
2  
@Gracchus I find it much easier to use iptables-save , save the output to a file, edit it with vim or emacs, and reimport the edited file using iptables-apply –  pepoluan Aug 25 '13 at 17:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.