36

i want to allow all traffic to specific ip, using iptables.

tryed by adding lines:

/sbin/iptables -A INPUT -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -s  XXX.XXX.XXX.XXX -j ACCEPT

... but still can not acess to remote ip (XXX.XXX.XXX.XXX).

any advice?

tnx in adv!

EDIT: with your advices i have changed iptables. still i can not connect to remote server. iptables status looks like this:

[root@myserver ~]# /etc/init.d/iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Table: mangle
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Table: filter
Chain INPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
2    REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 reject-with tcp-reset 
3    DROP       all  --  0.0.0.0/0            0.0.0.0/0           state INVALID 
4    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
5    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpts:1024:65535 
6    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8443 
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3718 
8    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:88 
9    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:88 
10   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080 
11   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:8080 
12   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:873 
13   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:873 
14   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8880 
15   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
16   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443 
17   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:21 
18   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:20 
19   ACCEPT     tcp  --  XXX.XXX.XXX.XXX      0.0.0.0/0           
20   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
21   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:587 
22   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:25 
23   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:465 
24   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:110 
25   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:995 
26   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:143 
27   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:993 
28   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:106 
29   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306 
30   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:5432 
31   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:9008 
32   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:9080 
33   DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:137 
34   DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:138 
35   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:139 
36   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:445 
37   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:1194 
38   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53 
39   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:53 
40   ACCEPT     icmp --  207.250.234.40       0.0.0.0/0           icmp type 8 code 0 
41   DROP       icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8 code 0 
42   DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
2    REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 reject-with tcp-reset 
3    DROP       all  --  0.0.0.0/0            0.0.0.0/0           state INVALID 
4    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
5    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8443 
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3718 
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:88 
8    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:88 
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080 
10   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:8080 
11   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:873 
12   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:873 
13   DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
2    REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 reject-with tcp-reset 
3    DROP       all  --  0.0.0.0/0            0.0.0.0/0           state INVALID 
4    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
5    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpts:1024:65535 
6    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8443 
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3718 
8    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:21 
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:20 
10   ACCEPT     tcp  --  0.0.0.0/0            XXX.XXX.XXX.XXX      
11   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:88 
12   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:88 
13   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080 
14   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:8080 
15   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:873 
16   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:873 
17   ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

[root@myserver ~]# 
2
  • I assume that if you stop the IPtables service completely, you are able to connect to the site, right?
    – David Z
    Jul 22, 2010 at 20:55
  • Check reply if is a good response @user48058 Aug 3, 2017 at 9:13

4 Answers 4

41

I think you need change one of your -s flags to a -d flag. If your XXX.XXX.XXX.XXX address is outside the firewall, it should be

/sbin/iptables -A INPUT -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -d  XXX.XXX.XXX.XXX -j ACCEPT

otherwise, the other way around

2
  • does iptables require service restart? In my case (Ubuntu 19.04), it does not require, just do iptables -A and rules take effect
    – Sang
    Dec 5, 2019 at 15:02
  • 2
    iptables don't require a restart
    – secavfr
    May 8, 2020 at 22:21
16

-A appends. This adds the rule in the end of the rules list, so incoming connection could be dropped by a rule higher in the list.

To make sure that all connections from or to an IP address are accepted, change -A to -I which inserts the rule at the top of the list:

iptables -I INPUT -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT
iptables -I OUTPUT -p tcp -d  XXX.XXX.XXX.XXX -j ACCEPT`
13

-s indicates the source. For OUTPUT you're going to want it as the destination (-d).

2

What's the rest of your ruleset look like? -A appends, so if you've got a -p tcp -s xxx.xxx.xxx.xxx -j REJECT or (more likely) -j REJECT at the end of the list before you do that, it's not going to do any good.

4
  • still not working, can you please check my iptables status, i have edited my prime post. tnx in adv!
    – user48058
    Jul 22, 2010 at 19:12
  • Why on earth are you dropping "tcp dpts:1024:65535" in INPUT and OUTPUT? That's the source of your problem, I'm sure. You can verify this by looking at the hit counts (iptables -L -n -v), do the thing that isn't working, then look again at the counts.
    – Bill Weiss
    Jul 22, 2010 at 21:47
  • Move your -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT way up and try again. Try /sbin/iptables -I INPUT 1 -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT and /sbin/iptables -I OUTPUT 1 -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT
    – Bill Weiss
    Jul 22, 2010 at 21:48
  • Why "tcp dpts:1024:65535" in INPUT and OUTPUT? That's the source of your problem, I can bet.
    – Net Runner
    Aug 3, 2017 at 10:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .