Simple configuration with mail server with 993 imap port. Local IP is static natted at main router to public IP. I need to restrict access to 993 port by local lan and allow connection to imapl port by "special" myknown ports. Understand that source IP connecting to "special" ports are public. So I wonder can it be performed by local iptables or do I need to route "special" ports by other local host? What did I miss?

iptables -A INPUT -p tcp --dport 33333 -j ACCEPT
iptables -A INPUT -p tcp --dport 33334 -j ACCEPT
iptables -A INPUT -p tcp -s --dport 993  -j ACCEPT
iptables -A PREROUTING -t nat -p tcp --dport 33333 -j REDIRECT  --to-port 993
iptables -A PREROUTING -t nat -p tcp --dport 33334 -j REDIRECT  --to-port 993

Update: I need to open ports 33333 and 33334 for internet and local lan and keep opened 993 port for local lan only. 33333 and 33334 ports are forwarded to 993. Forwarding doesn't work in case 993 restricted: -s Server has one ethernet interface.

  • You should describe which problem you are observing. What does not work as intended? And you should give examples for local and Internet source addresses what shall work and what shall not. – Hauke Laging Aug 12 '17 at 23:35
  • if your server has only one NIC, that implies another machine is performing the router/gateway/firewall functions - block incoming port 993 at your router. Alternatively, you could connect the router directly to the server via a second NIC and then you can have iptables rules based on interface rather than just address. The other hosts on your LAN would connect to your server via a switch. – cas Aug 13 '17 at 9:45
  • I've got your point. Thanks. There is only one router doing static nat public ip=local ip for server. So I will add second interface to perform internal routing on server. Guess it will work as needed. – Andrew Aug 13 '17 at 10:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.