Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I use iptables to reject all traffic to localhost port 80 but allow the one that comes from local machine?

Here is my current solution that doesn't seems to block the traffic. the ip, the the ip of the local machine. If I do not put the 2nd line, all the traffic is block, and with it enabled, all the traffic is accepted ?!

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

iptables -A INPUT -p tcp --dport 80 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -s 10.80.225.83 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j LOG --log-prefix "TCP LOGDROP: "

Just to be sure:

  • 10.80.225.83 is the ip of the web server, where I want to be able to access 127.0.0.1:80
  • I do want 10.80.225.83 to reject any connections on port 80, others then the ones originated from localhost.
share|improve this question
    
how exactly are you trying to connect? what hostname/ip do you try to connect to? –  stew Jul 13 '12 at 15:12
    
I am trying to connect to using one of the DNS entries mapping to 10.80.225.83, nginx is listening to ports 80 and 443. 443 is configured to fallback to 80 and keep the hostname requested. I just want an iptables rule that I can run to prevent direct connection to port 80 to this machine. –  sorin Jul 13 '12 at 15:14
1  
You do realise that localhost == 127.0.0.1 don't you ? –  Iain Jul 13 '12 at 15:18
add comment

2 Answers

iptables -I INPUT ! -i lo -p tcp --dport 80 -j DROP

When you the traffic goes from your machine to your machine, always has the input interface "lo". It doesn't matter the src or dst IP address.

share|improve this answer
    
I usually see iptables rules -A (appending) to a chain, is there a particular reason you use insert (-I)? –  Luc Aug 12 '13 at 14:02
    
Depends on your rule set. That command inserts the rule in the first place, but if you have the rules in a file, you should know where is the best place for it. And you must use -A there. –  diegows Aug 14 '13 at 14:33
add comment

Could you please provide the entire contents of /etc/sysconfig/iptables if possible? (i'll update my answer if applicable once the information is made available)

As I have to work on the assumption that there is no default DROP rule in place, as such you need:

iptables -A INPUT -p tcp --dport 80 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -s 10.80.225.83 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j LOG --log-prefix "TCP LOGDROP: "

iptables -A INPUT -p tcp --dport 80 -j DROP

share|improve this answer
    
The file does not exist at all and as you've seen, I am resetting iptables, just to be sure. From what I see the 4th line, added by you is doing almost the same as the 3rd one, the only difference being that mine is logging the dropped packages, which is good for debugging. –  sorin Jul 13 '12 at 17:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.