Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know how to reject a specific ip(s), but how about rejecting all except one ip?

Reject only 1: iptables -A FORWARD -s 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT.

in this case I reject 1.2.3.4 from telneting to 2.2.2.2

share|improve this question
    
Could you please mark my answer or cjc's as the correct one? –  gparent Apr 24 '12 at 23:05

2 Answers 2

You're doing this what is commonly considered the 'wrong' way. You do not want to blacklist specifically disallowed things, you want to whitelist allowed things. That way your default is secure (REJECT/DROP) and you only whitelist things when needed.

To answer your question though, a lot of arguments in iptables can be negated with !

So in your case you would use:

iptables -A FORWARD -s ! 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT

Consider switching the default policy to reject though.

share|improve this answer

Use ! to negate. Something like:

iptables -A FORWARD -s ! 1.2.3.4 -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23 -j REJECT

will allow only IP 1.2.3.4 through.

You can also use tcpwrappers (i.e., /etc/hosts.allow and /etc/hosts.deny), but that's less, hmm, "hard", as telnet will still respond.

As a side note, you should probably move away from telnet to ssh, etc., though that may not be possible in your circumstances, I suppose.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.