Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to DENY access to port 1000 when it is being accessed through any host or IP that is NOT a specific host.

If I try to access the service on sub.domain.com:1000 I should get in.
If I try to access the service on sub.domain2.com:1000 I should not get in, even though both of these domains are A-records pointing to the same server.

I'm trying to accomplish this using iptables with the following rules, but it's not working. It's allowing connections to any destination host/ip, not just the one I have set an ACCEPT rule to.

iptables -A INPUT -p tcp --destination sub.domain.com --dport 1000 -j ACCEPT
iptables -A INPUT -p tcp --dport 1000 -j DROP

The sub.domain2.com in this example, hosts different services, which is why I can't simply remove that DNS pointer.

share|improve this question
Which part is "not working"? – goldilocks Jan 2 '14 at 14:37
Oh right, sorry. I guess I should have been more specific. I've updated my question – Patrik Alienus Jan 2 '14 at 15:05
Well I though it was easy but after some search it seems that iptables is not the tool to use in that case. – Kiwy Jan 2 '14 at 15:17
Any idea which tool I should be using?.. – Patrik Alienus Jan 2 '14 at 15:19
iptables is the wrong tool for this. The hostname is up higher in the OSI stack, iptables can only operate on the lower level. If it's a webserver, you can use Nginx or Apache to control access based on the hostname, for example. en.wikipedia.org/wiki/OSI_model – slm Jan 2 '14 at 15:47
up vote 5 down vote accepted

IPTables is working on IP and TCP level, so it doesn't actually know DNS.

When a client creates a TCP connection to a DNS name it first looks up the IP address corresponding to the DNS name and then connects to the IP, not to the DNS name.

This means IPTables can't possibly know which DNS name a client is connecting to, it only knows which IP the client connects to.

If you specify --destination sub.domain.com as a parameter, IPTables will simply do a name look up to the IP that corresponds to this name, and then use the IP in it's rules.

If your port 1000 serves HTTP it would be possible to configure an HTTP server on that port to not handle requests to domains other than sub.domain.com, but IPTables doesn't have the necessary information to this.

If you could put sub.domain.com and sub.domain2.com onto two different IPs on the same server, then IPTables would be able to deny access to one but not to the other, because it could decide based on the IP.

This illustrates nicely that the Domain Name System is on top of Transport (TCP) and Internet (IP), for more details you can read the wikipedia article about it:


share|improve this answer
might want to mention the OSI model, perhaps showing which layers correspond to what he wants to do vs. what iptables will allow you to do? en.wikipedia.org/wiki/OSI_model – slm Jan 2 '14 at 15:48
@slm right, done – mauro.stettler Jan 2 '14 at 15:51
Thanks, this question has come up enough times that answering it like this will likely help others who don't understand the stack and where things can/can't be done 8-) – slm Jan 2 '14 at 15:53
I feel silly now. I should have known that iptables wasn't the right tool... I mean, it's pretty much in the name :) Thanks for the thorough answer. – Patrik Alienus Jan 2 '14 at 22:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.