I have a docker elastic search cluster running on Ubuntu, since docker writes directly to iptables and by default allows connections from any ip address I am trying to add rules to the iptables to only allow connections from 2x specific ip addresses.

iptables -I DOCKER-USER -i ens160 ! -s, -j DROP

When I run this command I get the following error:

iptables v1.6.1: ! not allowed with multiple source or destination IP addresses

Any ideas how I can do this?

1 Answer 1


You can split the rule into a RETURN (or ACCEPT if you prefer) rule and a DROP rule:

iptables -I DOCKER-USER -i ens160 -j DROP
iptables -I DOCKER-USER -i ens160 -s, -j RETURN

The -I operator will insert the second rule before the first one.

  • That worked perfectly! Thank you very much. Jan 8, 2020 at 7:22
  • @piotr-p-karwasz comment helped solve this problem but it didn't work as is. I had to start with a "-F" to clear it, and use "-A" rather than "-I" for the DROP so it will be in the end. iptables -F DOCKER-USER; iptables -I DOCKER-USER -i ens160 -s, -j RETURN; iptables -A DOCKER-USER -i ens160 -j DROP;
    – naviram
    Jun 25, 2023 at 20:58
  • @naviram: thanks, I corrected the order in the answer. Jun 25, 2023 at 21:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .