How do I use iptables to reject all traffic to localhost port 80 but allow the one that comes from local machine?

Here is my current solution that doesn't seems to block the traffic. the ip, the the ip of the local machine. If I do not put the 2nd line, all the traffic is block, and with it enabled, all the traffic is accepted ?!

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT

iptables -A INPUT -p tcp --dport 80 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j LOG --log-prefix "TCP LOGDROP: "

Just to be sure:

  • is the ip of the web server, where I want to be able to access
  • I do want to reject any connections on port 80, others then the ones originated from localhost.
  • how exactly are you trying to connect? what hostname/ip do you try to connect to? – stew Jul 13 '12 at 15:12
  • I am trying to connect to using one of the DNS entries mapping to, nginx is listening to ports 80 and 443. 443 is configured to fallback to 80 and keep the hostname requested. I just want an iptables rule that I can run to prevent direct connection to port 80 to this machine. – sorin Jul 13 '12 at 15:14
  • 1
    You do realise that localhost == don't you ? – user9517 Jul 13 '12 at 15:18
iptables -I INPUT ! -i lo -p tcp --dport 80 -j DROP

When you the traffic goes from your machine to your machine, always has the input interface "lo". It doesn't matter the src or dst IP address.

  • I usually see iptables rules -A (appending) to a chain, is there a particular reason you use insert (-I)? – Luc Aug 12 '13 at 14:02
  • Depends on your rule set. That command inserts the rule in the first place, but if you have the rules in a file, you should know where is the best place for it. And you must use -A there. – Diego Woitasen Aug 14 '13 at 14:33

Could you please provide the entire contents of /etc/sysconfig/iptables if possible? (i'll update my answer if applicable once the information is made available)

As I have to work on the assumption that there is no default DROP rule in place, as such you need:

iptables -A INPUT -p tcp --dport 80 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j LOG --log-prefix "TCP LOGDROP: "

iptables -A INPUT -p tcp --dport 80 -j DROP

  • The file does not exist at all and as you've seen, I am resetting iptables, just to be sure. From what I see the 4th line, added by you is doing almost the same as the 3rd one, the only difference being that mine is logging the dropped packages, which is good for debugging. – sorin Jul 13 '12 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.