Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know how to reject a specific ip(s), but how about rejecting all except one ip?

Reject only 1: iptables -A FORWARD -s -d -i eth0 -p tcp -m tcp --dport 23 -j REJECT.

in this case I reject from telneting to

share|improve this question
Could you please mark my answer or cjc's as the correct one? – gparent Apr 24 '12 at 23:05

You're doing this what is commonly considered the 'wrong' way. You do not want to blacklist specifically disallowed things, you want to whitelist allowed things. That way your default is secure (REJECT/DROP) and you only whitelist things when needed.

To answer your question though, a lot of arguments in iptables can be negated with !

So in your case you would use:

iptables -A FORWARD -s ! -d -i eth0 -p tcp -m tcp --dport 23 -j REJECT

Consider switching the default policy to reject though.

share|improve this answer

Use ! to negate. Something like:

iptables -A FORWARD -s ! -d -i eth0 -p tcp -m tcp --dport 23 -j REJECT

will allow only IP through.

You can also use tcpwrappers (i.e., /etc/hosts.allow and /etc/hosts.deny), but that's less, hmm, "hard", as telnet will still respond.

As a side note, you should probably move away from telnet to ssh, etc., though that may not be possible in your circumstances, I suppose.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.