Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Trying to limit a staging server to a specific set of IP's that can access it. How would I do this for iptables or is there a better way to do it?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

If you're going to have more than one or two servers, I'd make a new chain for your service. Set up a rule on the INPUT chain to jump to that new chain, set the default policy on the new chain to REJECT, and then just insert rules to ACCEPT when the source is any of the allowed machines.

iptables -A INPUT (whatever criteria defines your service) -j newservice
iptables -X newservice # delete existing chain
iptables -N newservice # create new chain again
iptables -P newservice REJECT # set default policy
iptables -A newservice --src 192.168.0.1 -j ACCEPT
iptables -A newservice --src 192.168.0.2 -j ACCEPT

You just run that last line over and over with additional IPs.

share|improve this answer
    
I'm confused what I would put on the first line. What do you mean (whatever criteria defines your service?) I don't know iptables well. It should just be all connections denied unless ip is one of the --src then accept all. –  Daniel Fischer Feb 25 '13 at 20:29
    
I get iptables v1.4.4: Couldn't load target `newservice':/lib/xtables/libipt_newservice.so: cannot open shared object file: No such file or directory on first line. –  Daniel Fischer Mar 4 '13 at 23:00
    
iptables -P whitelist REJECT iptables: Bad built-in chain name. –  Daniel Fischer Mar 4 '13 at 23:03
    
you're right. the new chain creation has to happen first. so the first line should be last. I'll have to edit the answer. I think I did pretty well from memory, though. :) I presume you figured out tge rest, or do you still need help with the first rule? –  dannysauer Mar 5 '13 at 7:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.