1

I know how to reject a specific ip(s), but how about rejecting all except one ip?

Reject only 1: iptables -A FORWARD -s 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT.

in this case I reject 1.2.3.4 from telneting to 2.2.2.2

1
  • Could you please mark my answer or cjc's as the correct one?
    – gparent
    Apr 24, 2012 at 23:05

2 Answers 2

4

You're doing this what is commonly considered the 'wrong' way. You do not want to blacklist specifically disallowed things, you want to whitelist allowed things. That way your default is secure (REJECT/DROP) and you only whitelist things when needed.

To answer your question though, a lot of arguments in iptables can be negated with !

So in your case you would use:

iptables -A FORWARD -s ! 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT

Consider switching the default policy to reject though.

1

Use ! to negate. Something like:

iptables -A FORWARD -s ! 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT

will allow only IP 1.2.3.4 through.

You can also use tcpwrappers (i.e., /etc/hosts.allow and /etc/hosts.deny), but that's less, hmm, "hard", as telnet will still respond.

As a side note, you should probably move away from telnet to ssh, etc., though that may not be possible in your circumstances, I suppose.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .