How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port?


3 Answers 3


One liner:

iptables -I INPUT \! --src -m tcp -p tcp --dport 777 -j DROP  # if it's not, drop it

A more elegant solution:

iptables -N xxx # create a new chain
iptables -A xxx --src -j ACCEPT  # allow
iptables -A xxx --src -j ACCEPT  # allow
iptables -A xxx --src -j ACCEPT  # allow
iptables -A xxx -j DROP  # drop everyone else
iptables -I INPUT -m tcp -p tcp --dport 777 -j xxx  # use chain xxx for packets coming to TCP port 777
  • Do you know if I should also add this to the OUTPUT also? May 30, 2010 at 12:05
  • @Camran: you need to be more specific. In this particular case, if you replace INPUT with OUTPUT you would block some packets sent using some addresses of the server itself (and not routed/forwarded). I doubt this makes sense, unless maybe you want to block programs that bind to some specific interfaces. May 17, 2011 at 20:15
  • 1
    Don't forget you can also specify your sources in a chain like: --src
    – deed02392
    Jan 2, 2013 at 20:01
  • How would I later add a new allowed IP to the chain? Would I have to remove the DROP first, then enter the new user and insert the DROP again or is there a better solution?
    – maddo7
    Jun 3, 2015 at 20:15
  • 2
    @Matthias: iptables -I xxx --src -j ACCEPT Jun 3, 2015 at 20:17

Here's an example from one of my CentOS systems (addresses have been obfuscated):

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s -d --dport 22 -j ACCEPT
  • on centos, where to make this configuration permanent? (in ubuntu, we can use /etc/network/if-up.d/anyfile)
    – Kokizzu
    Mar 18, 2013 at 1:45
  • on CentOS it is: service iptables save. Jun 1, 2015 at 23:37

I use shorewall to configure IP table. Use a rule like to accept from one host to port 123.

ACCEPT net: $FW tcp 1234

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.