Currently I have an application that is running on 8080 front-ended by mod_proxy.

    <Location /hudson>
            Order allow,deny
            Allow from all
            ProxyPass http://localhost:8080/hudson
            ProxyPassReverse http://localhost:8080/hudson

I need to block TCP 8080 but not for the localhost how can this be done with IPtables?


You could try the following:

// accept all tcp on port 8080 from localhost  
iptables -I INPUT 1 -i lo -p tcp --dport 8080 -j ACCEPT  

[...] all your other rules  
// drop all other packets  
iptables -A INPUT -j DROP  

If you wanted to allow also 1 (or more) external/other IP you can use this:

// accept tcp on port 8080 from allowed_ip  
iptables -I INPUT 3 -i eth0 -p tcp --dport 8080 -s allowed_ip -j ACCEPT

Let me know how it goes :)


This would work:

iptables -A INPUT ! -s -p tcp -m tcp --dport 8080 -j DROP

Another approach: in server listening 8080, bind only to localhost: For apache it looks like following:

  • good answer. however he might want to have over virtual hosts listen on netIP. – Joshua D'Alton Mar 18 '11 at 7:08
  • Yep, this would not work for all cases, but when you only need to connect from loalhost and nothing else, it's better to listen on and don't have any iptables rules at all (especially for high loaded machines). – rvs Mar 18 '11 at 7:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.