Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Xen server with several Virtual Machines on it sitting along side normal pcs on my LAN. The VMs host content bound for web access. Httpd is one of them so lets use that as an example.

I would like to configure iptables (or my network) as such:

  1. Allow loopback

    -A INPUT -i lo -j ACCEPT
    -A OUTPUT -o lo -j ACCEPT
  2. Allow port 80 In/out-bound connections from/to the WAN (web).

  3. Allow port foo In/out-bound traffic to/from a whitelisted computer on the LAN, while denying the rest of the LAN.

    #allow one ip with port foo
    -A INPUT -i eth0 -p tcp -s 192.168.0.w --dport foo -m state --state NEW,ESTABLISHED -j ACCEPT
    -A OUTPUT -o eth0 -p tcp --sport foo -m state --state ESTABLISHED -j ACCEPT
    #block the rest of the lan
    -A INPUT -i eth0 -m iprange --src-range 192.168.1.x-192.168.1.y -j DROP
    -A OUTPUT -o eth0 -m iprange --src-range 192.168.1.m-192.168.1.n -j DROP
  4. DENY all other traffic of type.


Essential I would like my VMs only to be able to talk to the Web and other VMs (in a certain block range on the LAN). Is this possible just using iptables? If not how would I achieve this?

My current iptables look as such (most of which was pre-generated by centos):

# Generated by iptables-save v1.4.7 on Tue Mar 12 10:43:43 2013                 
:INPUT ACCEPT [0:0]                                                             
:FORWARD ACCEPT [0:0]                                                           
:OUTPUT ACCEPT [0:0]                                                          
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT                         
-A INPUT -p icmp -j ACCEPT                                                      
-A INPUT -i lo -j ACCEPT                                                        
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT                
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT             
-A INPUT -j REJECT --reject-with icmp-host-prohibited                           
-A FORWARD -j REJECT --reject-with icmp-host-prohibited                         
# Completed on Tue Mar 12 10:43:43 2013 

Currently with my development boxes I can access my content, but I'm looking to harden my network, and protect my non-server pcs. And I haven't had enough experience with iptables to trust my self with this.

Thanks in advance. P.S. I also need to take into consideration network communication between Dom0 and the VMs.

share|improve this question

At the first glance suggested rules seem to be fine. But do not forget to allow DNS-traffic - destination UDP port 53 to your DNS-servers on WAN.

share|improve this answer
Thanks for the hint about DNS totally slipped my mind, kinda need that hehehe. Any help for condition 2? I want to allow every IP request from outside the LAN (of course only after they have forwarded through the router). Should I just block every private internal IP that is not in my required range, with something like this? -I INPUT -m iprange --src-range -j DROP Or were you saying the pre-generated iptable is sufficient? – hwshadow Mar 15 '13 at 13:35
Okay, how many interfaces does your web-server have? – Gevial Mar 15 '13 at 13:44
at the moment one physical, multiple virtual (cause there are different vms right). I can add more though if required. – hwshadow Mar 15 '13 at 13:50

Maybe I answered my own question, was talking this over with a friend. This is what we came up with if it helps anyone.


-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

#DNS Servers
-A INPUT -i eth0 -p udp --sport 53 -j ACCEPT

#SSH conditional
-A INPUT -i eth0 -p tcp -s 192.168.0.x --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -d 192.168.0.x --sport 22 -m state --state ESTABLISHED -j ACCEPT

#communicate with some other server on the lan
-A INPUT -i eth0 -p tcp -s 192.168.0.y --dport yp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -d 192.168.0.y --sport yp -m state --state ESTABLISHED -j ACCEPT

-A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

-A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

#Drop other output to my LAN

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.