up vote -1 down vote favorite
share [g+] share [fb]

Hello I want to allow only ports 25 and 80 and all other ports to be closed. I tried to configure my Ubuntu linux, but I dropped all the ports...

sudo iptables -F
sudo iptables -P OUTPUT ACCEPT
sudo iptables -P FORWARD ACCEPT

sudo iptables -P INPUT DROP
sudo iptables -A INPUT -p tcp -m tcp --sport 25 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
link|improve this question
feedback

migrated from stackoverflow.com Nov 9 '11 at 20:34

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 5 down vote

You want "--dport", not "--sport", if you want to accept connections directed to port 25 or port 80.

link|improve this answer
Agreed. How you have it set now is telling it to only allow packets in to the server if the computer they came from sent the packets out ports 25 or 80, which is practically never. The packet itself will have a source port of a random high number and a destination port (i.e. your server) of 80 or 25. So the rule should say --dport – Safado Nov 9 '11 at 20:54
I tried replacing -sport with dport and the result is that I have no internet access -> 80 port is blocked.... – user1024036 Nov 12 '11 at 21:08
I tried replacing -sport with dport and the result is that I have no internet access -> 80 port is blocked.... I haven't hacked port 25, because I do not know how exactly but the idea is that the suggestion is not working. So the question is still open – user1024036 Nov 12 '11 at 21:11
Can you do "iptables -L -n" so we can see what your configuration looks like? – cjc Nov 13 '11 at 3:51
root@ubuntu:~# iptables -L Chain INPUT (policy DROP) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:www Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination root@ubuntu:~# – user1024036 Nov 14 '11 at 17:58
show 4 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.