Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to modify the iptables on my CentOS 5.8 server so that only specific ips can connect to the machine on a specific port.

Currently, I have the following in my iptables file:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -j ACCEPT

How would I modify that line if I wanted to allow access for only ips 1.1.1.1 and 1.1.1.2 for instance? (they might not necessarily be sequential ips when I do this for reals).

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

You can add a match for each specific source IP with the -s flag, then forbid all others (if there's no later catchall rule to do that last bit for you):

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -s 1.1.1.1 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -s 1.1.1.2 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -j REJECT

If the IPs that you wished to permit could be grouped by a subnet, you can simplify the rules slightly. For example, if you wished to permit 1.1.1.2 and 1.1.1.3, you could use

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -s 1.1.1.2/31 -j ACCEPT

again following it with a blanket REJECT, if needed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.