I know how to reject a specific ip(s), but how about rejecting all except one ip?
Reject only 1: iptables -A FORWARD -s 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT.
in this case I reject 1.2.3.4 from telneting to 2.2.2.2
I know how to reject a specific ip(s), but how about rejecting all except one ip?
Reject only 1: iptables -A FORWARD -s 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT.
in this case I reject 1.2.3.4 from telneting to 2.2.2.2
You're doing this what is commonly considered the 'wrong' way. You do not want to blacklist specifically disallowed things, you want to whitelist allowed things. That way your default is secure (REJECT/DROP) and you only whitelist things when needed.
To answer your question though, a lot of arguments in iptables can be negated with !
So in your case you would use:
iptables -A FORWARD -s ! 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT
Consider switching the default policy to reject though.
Use !
to negate. Something like:
iptables -A FORWARD -s ! 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT
will allow only IP 1.2.3.4 through.
You can also use tcpwrappers (i.e., /etc/hosts.allow and /etc/hosts.deny), but that's less, hmm, "hard", as telnet will still respond.
As a side note, you should probably move away from telnet to ssh, etc., though that may not be possible in your circumstances, I suppose.