Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I always get nervous when editing iptables as I know how simple it can be to end up blocking all traffic to the server, a rather large issue when your server is sitting on the cloud.

Would these be the correct series of commands?

iptables -A INPUT -p tcp --dport 123 -s -j ACCEPT 
iptables -A INPUT -p tcp --dport 123 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 123 -j DROP
share|improve this question
I guess you should also add the corresponding settings for the OUTPUT chain, to make sure that connections in the reverse direction are only to the allowed IPs from the allowed ports. Like iptables -A OUTPUT -p tcp --sport 123 -d -j ACCEPT. And of course the corresponding DROP line. – Isaac Feb 5 '13 at 17:19

This doesn't answer your question - others are doing a nice job of that - but it does address your other concern: locking yourself out of your remote server. Whenever I'm doing a big iptables change on a system, I always check that atd is running, then put an at job for about 10 minutes in the future to take the firewall down, something like

at now + 10 minutes
at> service iptables stop
at> ^D

That way I know that if I really foul up and lock myself out, in ten minutes' time I'll be able to get back in and fix things. If I finish my work, and I haven't fouled up, I can find that job with atq and delete it with atrm before it even runs.

share|improve this answer
That is pretty genius – The Digital Ninja Feb 5 '13 at 17:52
I'm glad you like it; it's saved my bum on several occasions. – MadHatter Feb 5 '13 at 20:51

It should work, but it can be improved. You haven't posted what your default INPUT policy is. If it is ACCEPT, then your commands should work, although not the most recommended one. If it is DROP, then you don't need the line before iptables-save.

The most recommended policy for iptables, as well as for any other firewall, is to DROP EVERYTHING and then explicitly allow the ports/protocols you want to permit. So you start with this -

iptables -A INPUT -j DROP

Then you explicitly allow the incoming traffic destined to port 123/tcp

iptables -A INPUT -p tcp --dport 123 -s -j ACCEPT

iptables -A INPUT -p tcp --dport 123 -s -j ACCEPT

share|improve this answer
If you want to drop everything "else", set a default policy. In particular, if iptables commands are executed in above order, you will have a problem. – Bittrance Feb 5 '13 at 17:28
I Agree. At the beginning you set the default policies for INPUT, OUTPUT, FORWARD and then explicitly open up the ports/protocols you need. – Daniel t. Feb 5 '13 at 17:30

In debian iptables package there is '/usr/sbin/iptables-apply' who ask you if all are ok after apply changes, if you do not repply the question then chages are undone.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.