1

I would like to modify the iptables on my CentOS 5.8 server so that only specific ips can connect to the machine on a specific port.

Currently, I have the following in my iptables file:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -j ACCEPT

How would I modify that line if I wanted to allow access for only ips 1.1.1.1 and 1.1.1.2 for instance? (they might not necessarily be sequential ips when I do this for reals).

2

You can add a match for each specific source IP with the -s flag, then forbid all others (if there's no later catchall rule to do that last bit for you):

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -s 1.1.1.1 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -s 1.1.1.2 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -j REJECT

If the IPs that you wished to permit could be grouped by a subnet, you can simplify the rules slightly. For example, if you wished to permit 1.1.1.2 and 1.1.1.3, you could use

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5000 -s 1.1.1.2/31 -j ACCEPT

again following it with a blanket REJECT, if needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.