Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Trying to limit a staging server to a specific set of IP's that can access it. How would I do this for iptables or is there a better way to do it?

share|improve this question
up vote 4 down vote accepted

If you're going to have more than one or two servers, I'd make a new chain for your service. Set up a rule on the INPUT chain to jump to that new chain, set the default policy on the new chain to REJECT, and then just insert rules to ACCEPT when the source is any of the allowed machines.

iptables -A INPUT (whatever criteria defines your service) -j newservice
iptables -X newservice # delete existing chain
iptables -N newservice # create new chain again
iptables -P newservice REJECT # set default policy
iptables -A newservice --src -j ACCEPT
iptables -A newservice --src -j ACCEPT

You just run that last line over and over with additional IPs.

share|improve this answer
I'm confused what I would put on the first line. What do you mean (whatever criteria defines your service?) I don't know iptables well. It should just be all connections denied unless ip is one of the --src then accept all. – Daniel Fischer Feb 25 '13 at 20:29
I get iptables v1.4.4: Couldn't load target `newservice':/lib/xtables/ cannot open shared object file: No such file or directory on first line. – Daniel Fischer Mar 4 '13 at 23:00
iptables -P whitelist REJECT iptables: Bad built-in chain name. – Daniel Fischer Mar 4 '13 at 23:03
you're right. the new chain creation has to happen first. so the first line should be last. I'll have to edit the answer. I think I did pretty well from memory, though. :) I presume you figured out tge rest, or do you still need help with the first rule? – dannysauer Mar 5 '13 at 7:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.