I have struggled throughout the years to get a solid understanding on iptables. Any time I try and read through the man pages my eyes start to glaze over.

I have a service that I only want to allow the localhost to have access to.

What terms (or configuration, if someone is feeling generous) should I Google for to allow only localhost host to have access to a given port?

  • 2
    What port is this service running on? Mar 14, 2011 at 14:44
  • 44344, its a service written in-house Mar 14, 2011 at 14:46
  • 2
    I would like to change my nick temporarily for 'iptablesrules' but I can't Mar 14, 2011 at 14:47
  • @Art, they only suck because I dont understand them :) Mar 14, 2011 at 14:48
  • @iptablessuck actually it looks like I can. But I won't cause I'm not sure I will be able to change it back :) Mar 14, 2011 at 14:53

2 Answers 2


If by service you mean a specific port, then the following two lines should work. Change the "25" to whatever port you're trying to restrict.

iptables -A INPUT -p tcp -s localhost --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP
  • 2
    "Anything coming from localhost to port 25, accept" and the second rule says "Drop anything coming into port 25". The first line is processed first, allowing localhost, and anything else will get dropped by the second line. Yes? Mar 14, 2011 at 14:49
  • 1
    That's correct!
    – Hyppy
    Mar 14, 2011 at 14:51
  • 4
    @Hyppy, how would you "undo" this?
    – tester
    Aug 17, 2013 at 2:28
  • 11
    @tester type those commands again, but replace -A with -D
    – pepoluan
    Aug 25, 2013 at 17:14
  • 1
    @Astronaut type 'sudo service iptables save' to save the changes. then reboot. you can check whether changes were saved by typing 'sudo iptables -L'
    – Vinayak
    Jan 13, 2017 at 7:03

I'd recommend:

iptables -A INPUT -i lo -p tcp --dport $APP_PORT -j ACCEPT
iptables -A INPUT -p tcp --dport $APP_PORT -j DROP

Because, self-addressed packets do not necessarily have as its source, but they all 'enter' from the lo interface.

Now, if you really want to understand iptables the first thing you should do is to download and print good diagrams explaining the relations of the netfilter tables. Here are two great ones:

Finally, read a lot of iptables HOWTO's. The practical examples would help you get up-to-speed real quick :)

  • ty! lo shows up for me after using these commands with the last command from this link cyberciti.biz/faq/howto-display-linux-iptables-loaded-rules iptables -L -v -n --line-numbers
    – user144330
    Aug 25, 2013 at 3:01
  • 2
    @Gracchus I find it much easier to use iptables-save , save the output to a file, edit it with vim or emacs, and reimport the edited file using iptables-apply
    – pepoluan
    Aug 25, 2013 at 17:16
  • 1
    @tech-pro Yes, REJECT is safe to use. It depends on what you are trying to accomplish and whether you want to be courteous to people trying to use the port. REJECT will send back a TCP RST packet telling the client that the machine is up but the port is closed. If you are closing a port that people might legitimately expect to use, then REJECT is good. If you expect only port scanners then DROP is better.
    – Law29
    Jan 5, 2016 at 7:17
  • 1
    @pepoluan Can you provide an example or two when self-addressed packets don't have as their source address?
    – x-yuri
    Mar 14, 2018 at 22:46
  • 2
    @x-yuri For example, I run unbound as DNS Cache, in front of dnscrypt-proxy. unbound binds to, and dnscrypt-proxy binds to When an app requests either unbound or dnscrypt-proxy to resolve an FQDN, guess what source address will unbound/dnscrypt-proxy responds from?
    – pepoluan
    Apr 1, 2018 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.