Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have struggled throughout the years to get a solid understanding on iptables. Any time I try and read through the man pages my eyes start to glaze over.

I have a service that I only want to allow the localhost to have access to.

What terms (or configuration, if someone is feeling generous) should I Google for to allow only localhost host to have access to a given port?

share|improve this question
What port is this service running on? – Bart De Vos Mar 14 '11 at 14:44
44344, its a service written in-house – iptablessuck Mar 14 '11 at 14:46
I would like to change my nick temporarily for 'iptablesrules' but I can't – Art Shayderov Mar 14 '11 at 14:47
@Art, they only suck because I dont understand them :) – iptablessuck Mar 14 '11 at 14:48
@iptablessuck actually it looks like I can. But I won't cause I'm not sure I will be able to change it back :) – Art Shayderov Mar 14 '11 at 14:53
up vote 28 down vote accepted

If by service you mean a specific port, then the following two lines should work. Change the "25" to whatever port you're trying to restrict.

iptables -A INPUT -p tcp -s localhost --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP
share|improve this answer
"Anything coming from localhost to port 25, accept" and the second rule says "Drop anything coming into port 25". The first line is processed first, allowing localhost, and anything else will get dropped by the second line. Yes? – iptablessuck Mar 14 '11 at 14:49
That's correct! – Hyppy Mar 14 '11 at 14:51
TCP should be in lowercase, there... – pepoluan Mar 14 '11 at 16:45
@Hyppy, how would you "undo" this? – tester Aug 17 '13 at 2:28
@tester type those commands again, but replace -A with -D – pepoluan Aug 25 '13 at 17:14

I'd recommend:

iptables -A INPUT -i lo -p tcp --dport $APP_PORT -j ACCEPT
iptables -A INPUT -p tcp --dport $APP_PORT -j DROP

Because, self-addressed packets do not necessarily have as its source, but they all 'enter' from the lo interface.

Now, if you really want to understand iptables the first thing you should do is to download and print good diagrams explaining the relations of the netfilter tables. Here are two great ones:

Finally, read a lot of iptables HOWTO's. The practical examples would help you get up-to-speed real quick :)

share|improve this answer
ty! lo shows up for me after using these commands with the last command from this link iptables -L -v -n --line-numbers – user144330 Aug 25 '13 at 3:01
@Gracchus I find it much easier to use iptables-save , save the output to a file, edit it with vim or emacs, and reimport the edited file using iptables-apply – pepoluan Aug 25 '13 at 17:16
I think depending on the use case, the second rule should explicitly REJECT instead of drop silently. Is it dropped silently as a best practice? Is REJECT safe to use? – Tech Pro Dec 31 '15 at 5:25
@tech-pro Yes, REJECT is safe to use. It depends on what you are trying to accomplish and whether you want to be courteous to people trying to use the port. REJECT will send back a TCP RST packet telling the client that the machine is up but the port is closed. If you are closing a port that people might legitimately expect to use, then REJECT is good. If you expect only port scanners then DROP is better. – Law29 Jan 5 at 7:17
I had a web server running on the port that I want be accessible only via local host. In other to deny immediately to someone who uses from the browser I thought REJECT might be better. If it's dropped the browser hangs on till the timeout occurs. Does reject make sense in this use case? – Tech Pro Jan 5 at 13:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.