1

I'm new to linux server. I'm currently trying to get an Ubuntu 10.10 server up and running for the first time and I'm using Webmin for administration. I'm stuck on the setting up the firewall. What I need to do is to ONLY allow a range of IPs (e.g 128.171.21.1 - 128.171.21.100) to access the HTTP server and Webmin. I've seen a lot of tutorials but none of them fits what I needed.

Thanks in advance!

2 Answers 2

3

You can use the following commands to allow access to HTTP server given that you have default policy set to DROP for INPUT and OUTPUT chains.

$ sudo iptables -A INPUT -i lo -j ACCEPT
$ sudo iptables -A OUTOUT -i lo -j ACCEPT
$ sudo iptables -A INPUT -s 128.171.21.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
$ sudo iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

$ sudo iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
$ sudo iptables -A INPUT  -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
$ sudo iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

All subnet 128.171.21.0/24 will be allowed to access your web server. You can customize it according to your needs.

Be careful, uou may need to allow other protocols such as SSH (port 22) to be able to access the server remotely.

EDIT: The last four rules added to allow the server to request DNS and HTTP.

4
  • Thanks for the reply. Since you said that this commands only allow access to the webserver (port 80), how bout the commands to give access to 128.171.21.0/24 subnet to ALL the ports instead? Thanks again.
    – eggman20
    Dec 22, 2010 at 10:23
  • You can just remove the --dport 80 and --sport 80 from the last two commands.
    – Khaled
    Dec 22, 2010 at 10:34
  • Sorry, one more thing, would this allow the server to get an update? I tried updating the server and it couldn't resolve any site. I get an error "Temporary failure 'us.archive.ubuntu.com'". Would rules blocked any updates on my server? Thanks again.
    – eggman20
    Dec 24, 2010 at 0:13
  • @eggman20: You can check the answer again. I added the necessary rules.
    – Khaled
    Dec 24, 2010 at 8:00
0

If you find iptables too cryptic, Ubuntu has a simple iptables wrapper called ufw.

2
  • You may need to provide an example to get him started :)
    – Khaled
    Dec 24, 2010 at 17:10
  • The link in my answer points to the HOWTO, which has examples for both a default DENY policy and an ALLOW rule for a certain IP. Stating that "I've seen a lot of tutorials but none of them fits what I needed" without providing any examples of rulesets that don't work triggers suspicions. I don't want the eventual example from my answer to become "one more tutorial that doesn't fit", but I'm sure that if the OP will post a ruleset for ufw that doesn't work for him, other SF readers will be able to tell him what's wrong with them.
    – halp
    Dec 25, 2010 at 9:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .