Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two network interfaces eth0 and an alias eth0:1 that is my internal network. I want to block port 8140 but also have a rule allowing ANYTHING from the eth0:1 subnet (192.168.1.0/24)

Here is the rule that I have but it seems to be blocking 8140 on all interfaces

iptables -A INPUT -s 192.168.1.0/24  -j ACCEPT
iptables -A INPUT -p tcp --destination-port 8140 -j DROP


Chain INPUT (policy ACCEPT 7 packets, 400 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0           
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:8140 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 10 packets, 1400 bytes)
 pkts bytes target     prot opt in     out     source               destination    
share|improve this question
1  
Please append the output of iptables -L -v -n to your post. –  quanta Oct 11 '11 at 4:06

3 Answers 3

up vote 1 down vote accepted

Try this:

iptables -A INPUT -p tcp -s \! 192.168.1.0/24 --dport 8140 -j DROP
share|improve this answer
    
That rule still seems to block port 8140 on all connections –  The Digital Ninja Oct 11 '11 at 3:58
    
in that case, probably this: "iptables -A INPUT -i eth0:1 -p tcp -s \! 192.168.1.0/24 --dport 8140 -j DROP" –  Rilindo Oct 15 '11 at 19:56

Please the sequence of the writing the rule.

First write the second rule as you have typed. and the write the second rule.

Then after save the iptables and restart the iptables service to make it effective. Then do testing of it.

It should work.

share|improve this answer

You are unclear about what you want to happen - if you want to block TCP/8140 regardless of where it is coming from, it should be the first rule, otherwise, your existing setup is fine; 192.168.1.0/24 is free to communicate with 8140, everything else cannot.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.