-1

Currently, I'm allowing all TCP connections to port 80 on my :

-A INPUT -p tcp --dport 80 -j ACCEPT

I'd like to allow all TCP connections to port 5432, but only from my local network. Is there a way to do that, using iptables?

I'm using Ubuntu 12.04.1 LTS server 64bit, but if the answer works the same for most flavors of Linux, let me know and I can update the question title upon your answer.

1
  • If you read the first reason on the down vote tooltip you' 'll understand fully why someone downvoted your question.
    – user9517
    Dec 18, 2012 at 7:05

1 Answer 1

3

Yes, the man page for iptables explains the -s option in detail:

iptables -A INPUT -p tcp --dport 80 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j REJECT

Assuming that your local network is 192.168.0.0/24

4
  • Thanks, that's really helpful. BTW, if I already include -A INPUT -j REJECT and -A FORWARD -j REJECT at the bottom of my rules, do I still need the second line, due to any specific nature of using the -s flag?
    – orokusaki
    Dec 18, 2012 at 1:26
  • 1
    No, I just included that as I didn't know what the rest of your rules look like. Depending on the complexity of your rules, it's good to include that anyway; for example if further in your rules you add something like -A InPUT -s 192.0.2.0/24 -j ACCEPT to accept from that source, they also have access to http even though they're not included in the original http rule. That may or may not be desirable.
    – fukawi2
    Dec 18, 2012 at 1:57
  • Thanks. That's really interesting. The way the rules are interpreted reminds me a bit of CSS.
    – orokusaki
    Dec 18, 2012 at 17:44
  • 1
    You're welcome; just remember that every target (except LOG) is a 'terminating' rule (so no further rules are processed for that packet), and rules are processed in a 'first match' pattern.
    – fukawi2
    Dec 18, 2012 at 22:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .