1

With IPTABLES, Is it possible to DROP all network INPUT based on the host or the IP requested?

I want my server reject all incoming transmission if it is the IP who is called E.G.:

  • Dropped:
    • ssh user@192.168.0.10
    • http://​192.168.0.10
  • Accepted:
    • ssh user@server.local
    • http://server.local

The bonus will be it accept only based on the /etc/hosts for its IP…

I know it is possible for HTTP and HTTPS with rules like this:

iptables -I INPUT -p tcp --dport 80 -m string --to 700 --algo bm --string 'Host: 192.168.0.10' -j DROP
iptables -I INPUT -p tcp --dport 443 -m string --to 700 --algo bm --string 'Host: 192.168.0.10' -j DROP

and I'm sure it's possible for other protocols, but I don't find how for the moment…

Thanks in advance for your help.

3
  • Your subject line is misleading & inconsistent to actual question.
    – poige
    Mar 21 '13 at 12:03
  • How so? Why is it misleading or inconsistent?
    – Pascal Qyy
    Mar 21 '13 at 12:05
  • Cause the answer to your q-n in Subject is just iptables -I INPUT 1 -j DROP
    – poige
    Mar 21 '13 at 15:01
3

It is not possible with iptables. iptables is network-layer tool.

As for SSH, resolving is made on client side, so your server merely doesn't aware if client has typed IP or DNS name.

HTTP-requests contain "Host:" header, so suggested filtering can be done with web-server software.

2
  • It works fine for http with a rule like iptables -I INPUT -p tcp --dport 80 -m string --to 700 --algo bm --string 'Host: 192.168.0.10' -j DROP, so it is possible. I just want to figure out how for other protocols…
    – Pascal Qyy
    Mar 21 '13 at 11:43
  • As slimsuperhero notes, it can't be done with most protocols. HTTP is unusual in that some insight into how the client decided to reach the server's IP address is transmitted as part of the request to the server; this is not normal.
    – MadHatter
    Mar 21 '13 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.