74

I have struggled throughout the years to get a solid understanding on iptables. Any time I try and read through the man pages my eyes start to glaze over.

I have a service that I only want to allow the localhost to have access to.

What terms (or configuration, if someone is feeling generous) should I Google for to allow only localhost host to have access to a given port?

7
  • 2
    What port is this service running on? Commented Mar 14, 2011 at 14:44
  • 44344, its a service written in-house Commented Mar 14, 2011 at 14:46
  • 2
    I would like to change my nick temporarily for 'iptablesrules' but I can't Commented Mar 14, 2011 at 14:47
  • @Art, they only suck because I dont understand them :) Commented Mar 14, 2011 at 14:48
  • @iptablessuck actually it looks like I can. But I won't cause I'm not sure I will be able to change it back :) Commented Mar 14, 2011 at 14:53

3 Answers 3

84

If by service you mean a specific port, then the following two lines should work. Change the "25" to whatever port you're trying to restrict.

iptables -A INPUT -p tcp -s localhost --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP
8
  • 2
    "Anything coming from localhost to port 25, accept" and the second rule says "Drop anything coming into port 25". The first line is processed first, allowing localhost, and anything else will get dropped by the second line. Yes? Commented Mar 14, 2011 at 14:49
  • 1
    That's correct!
    – Hyppy
    Commented Mar 14, 2011 at 14:51
  • 4
    @Hyppy, how would you "undo" this?
    – tester
    Commented Aug 17, 2013 at 2:28
  • 11
    @tester type those commands again, but replace -A with -D
    – pepoluan
    Commented Aug 25, 2013 at 17:14
  • 1
    @Astronaut type 'sudo service iptables save' to save the changes. then reboot. you can check whether changes were saved by typing 'sudo iptables -L'
    – Vinayak
    Commented Jan 13, 2017 at 7:03
35

I'd recommend:

iptables -A INPUT -i lo -p tcp --dport $APP_PORT -j ACCEPT
iptables -A INPUT -p tcp --dport $APP_PORT -j DROP

Because, self-addressed packets do not necessarily have 127.0.0.1 as its source, but they all 'enter' from the lo interface.

Now, if you really want to understand iptables the first thing you should do is to download and print good diagrams explaining the relations of the netfilter tables. Here are two great ones:

Finally, read a lot of iptables HOWTO's. The practical examples would help you get up-to-speed real quick :)

8
  • ty! lo shows up for me after using these commands with the last command from this link cyberciti.biz/faq/howto-display-linux-iptables-loaded-rules iptables -L -v -n --line-numbers
    – user144330
    Commented Aug 25, 2013 at 3:01
  • 2
    @Gracchus I find it much easier to use iptables-save , save the output to a file, edit it with vim or emacs, and reimport the edited file using iptables-apply
    – pepoluan
    Commented Aug 25, 2013 at 17:16
  • 2
    @tech-pro Yes, REJECT is safe to use. It depends on what you are trying to accomplish and whether you want to be courteous to people trying to use the port. REJECT will send back a TCP RST packet telling the client that the machine is up but the port is closed. If you are closing a port that people might legitimately expect to use, then REJECT is good. If you expect only port scanners then DROP is better.
    – Law29
    Commented Jan 5, 2016 at 7:17
  • 1
    @pepoluan Can you provide an example or two when self-addressed packets don't have 127.0.0.1 as their source address?
    – x-yuri
    Commented Mar 14, 2018 at 22:46
  • 2
    @x-yuri For example, I run unbound as DNS Cache, in front of dnscrypt-proxy. unbound binds to 127.0.53.1:53, and dnscrypt-proxy binds to 127.0.53.2:53. When an app requests either unbound or dnscrypt-proxy to resolve an FQDN, guess what source address will unbound/dnscrypt-proxy responds from?
    – pepoluan
    Commented Apr 1, 2018 at 8:50
0

I had a similar problem. I configured iptables to deny incoming requests from all ports except the ones I specifically want to allow. I didn't bother to allow 27107 because I mistakenly reasoned that iptables affects only traffic from other hosts, and I don't need to expose this instance of mongodb to the outside world.

I was wrong about iptables. When I added this rule, it worked again:

-A INPUT -p tcp -m tcp -s localhost --dport 27017 -j ACCEPT

This tells netfilter to accept incoming traffic to port 27017 as long as it's from the local host.

If I want to access this instance of mongo from a different host (such as my laptop), I can still do so with an IP tunnel.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .