Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite
2

How do I allow certain ips and block all other connection in iptables?

share|improve this question
As Gilles demonstrates the concept goes like this: Add ACCEPT rules for each specific thing you want to allow whether by source IP or other qualifications, then set the default policy to REJECT. – Caleb Apr 23 '11 at 7:30

2 Answers

up vote 2 down vote

I wrote a blog post on basic Iptables rules for the desktop user a long time ago and you should probably read it, and its linked article on Stateful firewall design. But pre kernel 2.6.39 (which includes ipset and you may want to use that for whitelisting IP's if you have more than 10 to whitelist (where 10 is arbitrary)).

First handle state's that we know we want to accept or drop, and interfaces.

iptables -P FORWARD DROP # we aren't a router
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s 192.168.1.1 -j ACCEPT
iptables -P INPUT DROP # Drop everything we don't accept

If you just want to do an allow by IP only, without state

iptables -A INPUT -s 192.168.1.1 -j ACCEPT
iptables -A OUTPUT -d 192.168.1.1 -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP

you are likely to run into problems doing this though, and I suggest using state to make your life easier. For example, not allowing -i lo and -o lo will certainly cause problems for certain applications.

share|improve this answer
up vote 1 down vote

Here's an (untested!) example that blocks incoming connections only. Connections over the loopback interface, coming from 192.168.3.x, ICMP, or to the SSH port are allowed. All other connections are rejected.

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 192.168.3.0/24 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -j REJECT
share|improve this answer
@Gilles to properly use RELATED and ESTABLISHED states, you need to match the initial packet as a NEW state. lo in the above example is excluded from state matching and always allowed. – penguin359 Apr 22 '11 at 23:54
@penguin359: Could you elaborate on why NEW is needed? I'm far from an iptables expert, I partly copied these rules from my home router, which doesn't match on NEW. As far as I understand, all that's left after the first rule is NEW (or UNTRACKED) packets anyway. (If I'm too far off the mark and you can't explain in a comment, post your versions with explanations as an answer and I'll delete mine.) – Gilles Apr 23 '11 at 0:07
@Gilles I always drop INVALID state before accepting anything... which makes anything not INVALID, RELATED, ESTABLISHED, must be NEW state. But I don't know any reason that everything else must specify NEW. In theory though if you don't handle INVALID, and you don't specify NEW, you could end up accepting INVALID. But once INVALID is handled, it seems to me that checking for NEW state on every rule simply requires more processing for the packet. – xenoterracide♦ Apr 23 '11 at 9:29
@Gilles also a default policy of reject is bad, because it sends a reject packet for every packet that is received, this compounds a DOS attack. – xenoterracide♦ Apr 23 '11 at 9:30
@xenoterracide: Good point. Should REJECT ever be used? I've asked: Reject IP packets with an ICMP error, or just drop them? – Gilles Apr 23 '11 at 14:28
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.