Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently I have an application that is running on 8080 front-ended by mod_proxy.

    <Location /hudson>
            Order allow,deny
            Allow from all
            ProxyPass http://localhost:8080/hudson
            ProxyPassReverse http://localhost:8080/hudson

I need to block TCP 8080 but not for the localhost how can this be done with IPtables?

share|improve this question
up vote 3 down vote accepted

You could try the following:

// accept all tcp on port 8080 from localhost  
iptables -I INPUT 1 -i lo -p tcp --dport 8080 -j ACCEPT  

[...] all your other rules  
// drop all other packets  
iptables -A INPUT -j DROP  

If you wanted to allow also 1 (or more) external/other IP you can use this:

// accept tcp on port 8080 from allowed_ip  
iptables -I INPUT 3 -i eth0 -p tcp --dport 8080 -s allowed_ip -j ACCEPT

Let me know how it goes :)

share|improve this answer

This would work:

iptables -A INPUT ! -s -p tcp -m tcp --dport 8080 -j DROP
share|improve this answer

Another approach: in server listening 8080, bind only to localhost: For apache it looks like following:

share|improve this answer
good answer. however he might want to have over virtual hosts listen on netIP. – Joshua D'Alton Mar 18 '11 at 7:08
Yep, this would not work for all cases, but when you only need to connect from loalhost and nothing else, it's better to listen on and don't have any iptables rules at all (especially for high loaded machines). – rvs Mar 18 '11 at 7:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.