-1

Here's the situation. I have multiple Apache vhosts listening on port 443 on different IPs, on the same network interface.

I would like to only allow a certain IP to access one of those vhosts.

In other words, I would like the IP address 11.11.11.11 on port 443 to only be accessible from 22.22.22.22.

What is the correct rule to use to accomplish this? I still need port 443 to be generally open to all for the other vhosts that I don't need to restrict access.

1
  • -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --src 22.22.22.22/24 --sport 443 --dst 11.11.11.11 --dport 443 --jump ACCEPT [the problem is I need another rule to ban all other IPs trying to connect to that IP on port 443]
    – user788171
    Nov 12, 2015 at 16:01

1 Answer 1

2

You should not specify source port 443, the requests will have a different source port. You should not specify /24 if you just want to match one specific IP (22.22.22.22/24 should match 256 IPs, 22.22.22.0 to 22.22.22.255)

You need:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --src 22.22.22.22 --dst 11.11.11.11 --dport 443 --jump ACCEPT

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dst 11.11.11.11 --dport 443 --jump REJECT

REJECT will send back a packet so that clients other than 22.22.22.22 will be told that there is nothing listening (immediate error in the browser, not a timeout).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .