Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With IPTABLES, Is it possible to DROP all network INPUT based on the host or the IP requested?

I want my server reject all incoming transmission if it is the IP who is called E.G.:

  • Dropped:
    • ssh user@
    • http://​
  • Accepted:

The bonus will be it accept only based on the /etc/hosts for its IP…

I know it is possible for HTTP and HTTPS with rules like this:

iptables -I INPUT -p tcp --dport 80 -m string --to 700 --algo bm --string 'Host:' -j DROP
iptables -I INPUT -p tcp --dport 443 -m string --to 700 --algo bm --string 'Host:' -j DROP

and I'm sure it's possible for other protocols, but I don't find how for the moment…

Thanks in advance for your help.

share|improve this question
Your subject line is misleading & inconsistent to actual question. – poige Mar 21 '13 at 12:03
How so? Why is it misleading or inconsistent? – Pascal Qyy Mar 21 '13 at 12:05
Cause the answer to your q-n in Subject is just iptables -I INPUT 1 -j DROP – poige Mar 21 '13 at 15:01

It is not possible with iptables. iptables is network-layer tool.

As for SSH, resolving is made on client side, so your server merely doesn't aware if client has typed IP or DNS name.

HTTP-requests contain "Host:" header, so suggested filtering can be done with web-server software.

share|improve this answer
It works fine for http with a rule like iptables -I INPUT -p tcp --dport 80 -m string --to 700 --algo bm --string 'Host:' -j DROP, so it is possible. I just want to figure out how for other protocols… – Pascal Qyy Mar 21 '13 at 11:43
As slimsuperhero notes, it can't be done with most protocols. HTTP is unusual in that some insight into how the client decided to reach the server's IP address is transmitted as part of the request to the server; this is not normal. – MadHatter Mar 21 '13 at 12:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.