25

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port?

Thanks

48

One liner:

iptables -I INPUT \! --src 1.2.3.4 -m tcp -p tcp --dport 777 -j DROP  # if it's not 1.2.3.4, drop it

A more elegant solution:

iptables -N xxx # create a new chain
iptables -A xxx --src 1.2.3.4 -j ACCEPT  # allow 1.2.3.4
iptables -A xxx --src 1.2.3.5 -j ACCEPT  # allow 1.2.3.5
iptables -A xxx --src 1.2.3.6 -j ACCEPT  # allow 1.2.3.6
iptables -A xxx -j DROP  # drop everyone else
iptables -I INPUT -m tcp -p tcp --dport 777 -j xxx  # use chain xxx for packets coming to TCP port 777
  • Do you know if I should also add this to the OUTPUT also? – Anonymous12345 May 30 '10 at 12:05
  • @Camran: you need to be more specific. In this particular case, if you replace INPUT with OUTPUT you would block some packets sent using some addresses of the server itself (and not routed/forwarded). I doubt this makes sense, unless maybe you want to block programs that bind to some specific interfaces. – Cristian Ciupitu May 17 '11 at 20:15
  • 1
    Don't forget you can also specify your sources in a chain like: --src 1.2.3.4/30 – deed02392 Jan 2 '13 at 20:01
  • How would I later add a new allowed IP to the chain? Would I have to remove the DROP first, then enter the new user and insert the DROP again or is there a better solution? – maddo7 Jun 3 '15 at 20:15
  • 2
    @Matthias: iptables -I xxx --src 7.8.9.10 -j ACCEPT – Cristian Ciupitu Jun 3 '15 at 20:17
0

Here's an example from one of my CentOS systems (addresses have been obfuscated):

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 1.2.3.4 -d 5.6.7.8 --dport 22 -j ACCEPT
  • on centos, where to make this configuration permanent? (in ubuntu, we can use /etc/network/if-up.d/anyfile) – Kokizzu Mar 18 '13 at 1:45
  • on CentOS it is: service iptables save. – Martin Zeitler Jun 1 '15 at 23:37
0

I use shorewall to configure IP table. Use a rule like to accept from one host to port 123.

ACCEPT net:192.0.2.1 $FW tcp 1234

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.