Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I make it that only approved IP addresses have access to my Ubuntu server 12.04 I only just set it up.

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

You can achieve this with following commands provided you have UFW install:

To allow by a specific IP address use,

sudo ufw allow from XXX.XXX.XXX.XXX

To allow by a specific subnet we invoke netmask and use,

sudo ufw allow from XXX.XXX.XXX.XXX/XX

To allow by a specific port and an IP address you can use,

sudo ufw allow from XXX.XXX.XXX.XXX to AAA port YY

Please refer community documentation for advance help.


Using tcpwrappers,

/etc/hosts.deny is checked before /etc/hosts.allow, so you can go

  • hosts.deny

    ALL : ALL

first, we block everything from everyone,

  • hosts.allow

    ALL : localhost

    sshd: 192.168.0.2

which means only 192.168.0.2 on your local network can access ssh server on that machine.

share|improve this answer
1  
I suspect you might be able to do it with tcpwrappers (/etc/hosts.allow) too. –  Tom O'Connor Jun 29 '12 at 17:30
add comment

This would be accomplished with iptables (netfilter), the built-in firewall utility for Linux.

Depending on what you're doing with your server (and what you're serving), this will need to be (carefully) configured to permit the appropriate traffic.

There's a good tutorial on this at Ubuntu's official help website and there's also ufw (Uncomplicated Firewall) that's built in to Ubuntu to handle the basics. For example if you wanted to only permit SSH (TCP 22) access from 10.0.0.15, you'd do this:

sudo ufw allow proto tcp from 10.0.0.15 to any port 22

You can also use one of several handy iptables rule generators to generate an entire iptables ruleset.

Another suggestion (especially if this Ubuntu host will be on the Internet) would be to use SSH key pairs for authentication instead of passwords; I'd also disable root logins.

share|improve this answer
add comment

Worth noting - to catch the private address range (RFC1918) you probably want 192.168.0.0/16, -not- /8.

share|improve this answer
    
+1. That RFC recommends to limit the network part to not less than 16 bits for the 192.168 based networks. You could even take 192.168.0.0/24 which provides 254 possible addresses. More than enough for most private networks. –  ripat Jun 30 '12 at 7:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.