Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently, I'm allowing all TCP connections to port 80 on my :

-A INPUT -p tcp --dport 80 -j ACCEPT

I'd like to allow all TCP connections to port 5432, but only from my local network. Is there a way to do that, using iptables?

I'm using Ubuntu 12.04.1 LTS server 64bit, but if the answer works the same for most flavors of Linux, let me know and I can update the question title upon your answer.

share|improve this question
    
If you read the first reason on the down vote tooltip you' 'll understand fully why someone downvoted your question. –  Iain Dec 18 '12 at 7:05

1 Answer 1

up vote 3 down vote accepted

Yes, the man page for iptables explains the -s option in detail:

iptables -A INPUT -p tcp --dport 80 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j REJECT

Assuming that your local network is 192.168.0.0/24

share|improve this answer
    
Thanks, that's really helpful. BTW, if I already include -A INPUT -j REJECT and -A FORWARD -j REJECT at the bottom of my rules, do I still need the second line, due to any specific nature of using the -s flag? –  orokusaki Dec 18 '12 at 1:26
1  
No, I just included that as I didn't know what the rest of your rules look like. Depending on the complexity of your rules, it's good to include that anyway; for example if further in your rules you add something like -A InPUT -s 192.0.2.0/24 -j ACCEPT to accept from that source, they also have access to http even though they're not included in the original http rule. That may or may not be desirable. –  fukawi2 Dec 18 '12 at 1:57
    
Thanks. That's really interesting. The way the rules are interpreted reminds me a bit of CSS. –  orokusaki Dec 18 '12 at 17:44
1  
You're welcome; just remember that every target (except LOG) is a 'terminating' rule (so no further rules are processed for that packet), and rules are processed in a 'first match' pattern. –  fukawi2 Dec 18 '12 at 22:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.