iptables - how to allow IP when it is blocked by default

Question

I need to allow access to port 11211 from specific IP to existing rules (In a script that runs after the server loads)

The line I want to add:

iptables -A INPUT -p tcp -s xx.xx.xx.xx --dport 11211 -j ACCEPT

But the iptables already contains a drop line for this port so my line will append after and will never work. The drop line:

DROP       tcp  --  anywhere             anywhere            tcp dpt:11211

How can I do it?

Answer 1

You're looking for "INSERT" instead of "APPEND". AFAIR you can use

iptables -I INPUT <slot> -p tcp -s xx.xx.xx.xx --dport 11211 -j ACCEPT

To insert the rule into the desired slot in the chain. To find the right slot number use iptables -nL Then start counting the rules starting with 1.

I think you can also omit the slot to have iptables inserting the new rule at the first slot (on top).

Answer 2

Use iptables -I INPUT -p tcp -s xx.xx.xx.xx --dport 11211 -j ACCEPT this will insert the rule at the beginning of the INPUT chain and will be processed before the existing DROP rule. Iptables works from top to bottom and the 1st rule to match wins. Don't forget to save the iptables configuration once your sure it's working correctly.

Answer 3

-A -- means appent. use -R to replace and -I to insert in chain.