Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to block specific ports based on the IP used to connect to my (Linux) dedicated server.

For example, I have the following IP's assigned to my dedicated server:

The first IP ( would be used specifically for administrative purposes, such as SSH, FTP, WHM, and cPanel. This means that I would want things such as port 80 and port 443 blocked.

Then for the other two IP addresses ( and, I'd want to block the following ports: 21, 22, 2083, 2087, etc. This is because those IP addresses would only be used to serve websites, and should not be allowing access to "administrative ports".

I'd assume I'd have to use some sort of iptables rule, but I'm not exactly sure what.

Also, if it matters, I'm using CENTOS 5.

share|improve this question
If you're going to downvote my question, could you please take the time to state why I deserved the downvote? Thanks. – Josh Foskett Aug 5 '13 at 20:06
man iptables or use Google. I don't find this stuff (e.g. 'chains' in iptables) very easy but I do find the answers that way. BTW I think it's better and easier to just block all incoming traffic (rule 1) and then open port 80 (rule 2). – reinierpost Aug 5 '13 at 20:12
My guess is that the downvote is because you didn't explain where exactly you got stuck. It's as if you didn't even try. – reinierpost Aug 5 '13 at 20:13

I'd go the other way round: block everything and only allow specific services. In this example, your eth0 is configured with the, and the other two interfaces are used for the public services.

-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p tcp -m multiport --dports 21,22,2083,2087 -m state --state NEW -j ACCEPT
-A INPUT -i ! eth0 -p tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.