Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to allow access to certain ports on the server, via only one of the server IP addresses.

So for example if the server has two IP addresses: 1.1.1.1 1.1.1.2

I only want for example ports 25, 26 to be accessible via 1.1.1.2. I'm not trying to prevent any external IP addresses from accessing the ports, just trying to make sure that they can only access the ports on a certain IP address on the server.

I've been trying to write this using iptables, but I've so far been unsuccessful - I was wondering if anyone could help?

share|improve this question
1  
Show us that you've tried. iptables is the right tool - what have you tried with it? –  Andrew Schulman Dec 18 '13 at 12:46
1  
Note that showing us only lines starting with iptables -[AI] is basically useless, because iptables rules are position-depdendent. We need to see the output of iptables -L -n -v to have any hope of commenting usefully. –  MadHatter Dec 18 '13 at 12:57
    
Agreed. I should have mentioned that in my answer. –  Lawrence Dec 18 '13 at 12:58

1 Answer 1

up vote 0 down vote accepted

Assuming you have no existing rules for those 2 ports or any blanket accept rules, then these lines below are a good example.

These 2 lines will block access to port 25 and 26 on port 1.1.1.1. Assuming that the default policy is to accept packets.

iptables -A INPUT -p tcp --dport 25 -d 1.1.1.1 -j REJECT
iptables -A INPUT -p tcp --dport 26 -d 1.1.1.1 -j REJECT

Normally though, I would have the default policy on reject or drop and then explicitly allow the 2 ports on the second IP address.

iptables -P INPUT REJECT
iptables -A INPUT -p tcp --dport 25 -d 1.1.1.2 -j ACCEPT
iptables -A INPUT -p tcp --dport 26 -d 1.1.1.2 -j ACCEPT
share|improve this answer
    
Yeah, thats similar the solution I had but I was a little off with the ordering of the statements. Would the following work: iptables -P INPUT -p tcp --dport 25 INPUT REJECT iptables -P INPUT -p tcp --dport 26 INPUT REJECT iptables -A INPUT -p tcp --dport 25 -d 1.1.1.2 -j ACCEPT iptables -A INPUT -p tcp --dport 26 -d 1.1.1.2 -j ACCEPT –  jdawg Dec 18 '13 at 13:22
    
No, as it would reject anything that hits port 25 and port 26 regardless of which IP address it hits. –  Lawrence Dec 18 '13 at 13:58
    
I've worked it out for your answer - thanks :) –  jdawg Dec 18 '13 at 15:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.