Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I make it that only approved IP addresses have access to my Ubuntu server 12.04 I only just set it up.

share|improve this question
up vote 4 down vote accepted

You can achieve this with following commands provided you have UFW install:

To allow by a specific IP address use,

sudo ufw allow from XXX.XXX.XXX.XXX

To allow by a specific subnet we invoke netmask and use,

sudo ufw allow from XXX.XXX.XXX.XXX/XX

To allow by a specific port and an IP address you can use,

sudo ufw allow from XXX.XXX.XXX.XXX to AAA port YY

Please refer community documentation for advance help.

Using tcpwrappers,

/etc/hosts.deny is checked before /etc/hosts.allow, so you can go

  • hosts.deny

    ALL : ALL

first, we block everything from everyone,

  • hosts.allow

    ALL : localhost


which means only on your local network can access ssh server on that machine.

share|improve this answer
I suspect you might be able to do it with tcpwrappers (/etc/hosts.allow) too. – Tom O'Connor Jun 29 '12 at 17:30

This would be accomplished with iptables (netfilter), the built-in firewall utility for Linux.

Depending on what you're doing with your server (and what you're serving), this will need to be (carefully) configured to permit the appropriate traffic.

There's a good tutorial on this at Ubuntu's official help website and there's also ufw (Uncomplicated Firewall) that's built in to Ubuntu to handle the basics. For example if you wanted to only permit SSH (TCP 22) access from, you'd do this:

sudo ufw allow proto tcp from to any port 22

You can also use one of several handy iptables rule generators to generate an entire iptables ruleset.

Another suggestion (especially if this Ubuntu host will be on the Internet) would be to use SSH key pairs for authentication instead of passwords; I'd also disable root logins.

share|improve this answer

Worth noting - to catch the private address range (RFC1918) you probably want, -not- /8.

share|improve this answer
+1. That RFC recommends to limit the network part to not less than 16 bits for the 192.168 based networks. You could even take which provides 254 possible addresses. More than enough for most private networks. – ripat Jun 30 '12 at 7:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.