Home / server / Questions / 475701
In Process
The Digital Ninja
Asked: 2013-02-06 09:05:40 +0800 CST

iptables allow only certain ip's from a certain port

  • 772

I always get nervous when editing iptables as I know how simple it can be to end up blocking all traffic to the server, a rather large issue when your server is sitting on the cloud.

Would these be the correct series of commands?

iptables -A INPUT -p tcp --dport 123 -s 1.2.3.4 -j ACCEPT 
iptables -A INPUT -p tcp --dport 123 -s 5.6.7.8 -j ACCEPT
iptables -A INPUT -p tcp --dport 123 -j DROP
iptables-save
iptables

3 Answers

  1. This doesn't answer your question - others are doing a nice job of that - but it does address your other concern: locking yourself out of your remote server. Whenever I'm doing a big iptables change on a system, I always check that atd is running, then put an at job for about 10 minutes in the future to take the firewall down, something like

    at now + 10 minutes
at> service iptables stop
at> ^D

    That way I know that if I really foul up and lock myself out, in ten minutes' time I'll be able to get back in and fix things. If I finish my work, and I haven't fouled up, I can find that job with atq and delete it with atrm before it even runs.

    • 5

  2. It should work, but it can be improved. You haven't posted what your default INPUT policy is. If it is ACCEPT, then your commands should work, although not the most recommended one. If it is DROP, then you don't need the line before iptables-save.

    The most recommended policy for iptables, as well as for any other firewall, is to DROP EVERYTHING and then explicitly allow the ports/protocols you want to permit. So you start with this -

    iptables -A INPUT -j DROP

    Then you explicitly allow the incoming traffic destined to port 123/tcp

    iptables -A INPUT -p tcp --dport 123 -s 1.2.3.4 -j ACCEPT

    iptables -A INPUT -p tcp --dport 123 -s 5.6.7.8 -j ACCEPT

    • 2

  3. In debian iptables package there is '/usr/sbin/iptables-apply' who ask you if all are ok after apply changes, if you do not repply the question then chages are undone.

    • 0