1

I bought a small VPS system earlier today to handle my website database, and went away for a couple of hours, but when I came back and logged in again, I found that an IP address in China had been attempting to login 162 times:

enter image description here

I immediately blocked the IP range using sudo /sbin/iptables -A INPUT -s 61.174.51.0/24 -j DROP , but I want to increase the security of my system further and only allow a connection from a specific domain. The VPS system will only be accessed from %.wavetelecom.com and %.northhosts.co.uk, so I cannot see any issues occuring such as being locked out of the VPS.

This question is similar, but I want to lock out the whole system from everyone except two domains.

Is it possible to only allow connections from a specific domain on Linux (Fedora 19)?

Improve this question
5
  • 1
    Nothing has changed in the intervening 165 days to change the answer you already have.
    – user9517
    Mar 11, 2015 at 11:59
  • Indeed - which is in fact the correct answer, whether or not it matches what was desired.
    – BE77Y
    Mar 11, 2015 at 11:59
  • I opened the bounty to award the user who answered the question, but am unable to award it for 16 more hours. Extra downvotes on my questions are unwarranted and will possibly be reversed when the script is run.
    – AStopher
    Mar 11, 2015 at 18:49
  • @ʎǝʞuoɯɹǝqʎɔ You might, then, want to also accept the answer. Opening a bounty on a question where one has not accepted the answer tends to indicate dissatisfaction with the current answer(s). Your bounty message does nothing to discourage this interpretation.
    – 84104
    Mar 12, 2015 at 4:17
  • @84104 Yeah, I was chatting to a few users in the SE Meta Tavern about that and I simply went through the process too fast. Bounty can be awarded in two hours.
    – AStopher
    Mar 12, 2015 at 8:58

1 Answer 1

Reset to default
8
+100

Yes, this is possible. You will have to get a list of the IP addresses that those domains use and then add them as exceptions to the firewall.

With /etc/hosts.allow you could try something like

sshd : localhost : allow
sshd : .wavetelecom.com : allow
sshd : .northhosts.co.uk : allow
sshd : ALL : deny

Don't forget to ensure that the hosts in the listed domains have correct reverse dns RRs configured.

Improve this answer
8
  • Can't this be done by domain only, and not IP?
    – AStopher
    Sep 27, 2014 at 15:20
  • @AlexanderStopher think about this for a moment: How is iptables to know all of the hosts in those domains ?
    – user9517
    Sep 27, 2014 at 15:34
  • 3
    @AlexanderStopher You can't do that, iptables only resolves names->IP addresses when it starts, to do what you want would require it to do a reverse lookup (at least) every time a new connection is started ...
    – user9517
    Sep 27, 2014 at 17:12
  • 4
    Also, your security would be at the mercy of anyone who controls their own rDNS.
    – MadHatter
    Mar 11, 2015 at 11:44
  • 1
    There is suspicion in many quarters that much of the cyberactivity from China is indeed government-sponsored; if it were, they would be peculiarly well-able to control their own rDNS. In any case, that is only one of many reasons why you can't, or shouldn't, do what you want to do.
    – MadHatter
    Mar 12, 2015 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .