1

How can I make my Mongo only certain IP accesible?

I've tried iptables

iptables -A INPUT -s 192.168.2.111 -p tcp --destination-port 27016 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -d 192.168.2.111 -p tcp --source-port 27016 -m state --state ESTABLISHED -j ACCEPT
.

But, what exactly does that? How can I deny all other IP? How can I edit the iptables for adding more IP to allow and keeping blocking "not listed"? How can I make this iptables configuration persitent?

I try my best english.

2

But, what exactly does that?

This is only two alone rules with no meaning.

How can I deny all other IP?

There is two ways. The first is setting up deny policy with:

iptables -P INPUT DROP
iptables -P OUTPUT DROP

But this way is no best practice because if you reset all rules you will lost connection to server. Use the second way:

You need "accept all" policy with the last rule in chains that deny all traffic:

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT

some rule...
some rule...
some rule...

iptables -A INPUT --destination $host --jump DROP
iptables -A OUTPUT --source $host --jump DROP

Where $host - is the host's ip address

How can I edit the iptables for adding more IP to allow and keeping blocking "not listed"?

You can add severall addresses or ip subnets to a single rule. For example:

iptables -A INPUT --source 192.168.2.111,192.168.2.1,192.168.56.0/24 --destination $host --protocol tcp --dport 27016 --jump ACCEPT

How can I make this iptables configuration persitent?

With iptables-persistent


Pay attention: if you deny or drop all INPUT/OUTPUT traffic you need to define accepting rules for proper connection to server.

For ssh:

iptables -A INPUT --source 192.168.2.111 --protocol tcp --dport 22 --jump ACCEPT
iptables -A OUTPUT --match conntrack --ctstate ESTABLISHED,RELATED --jump ACCEPT

Use iptables carefully especially on remote servers which you cannot access directly if something went wrong.

  • Thank you, but when I run iptables -P INPUT DROP or iptables -P OUTPUT DROP the terminal hang. :( – Máxima Alekz Oct 5 '17 at 19:40
  • And then packet_write_wait: Connection to 192.168.2.180 port 22: Broken pipe – Máxima Alekz Oct 5 '17 at 19:41
  • Yes, it is normal. See Pay attention section above. Do not add rules line by line in terminal, do it in script – Egor Vasilyev Oct 5 '17 at 19:45
  • iptables uses rules by order. Place allowing rules at the top and denying rules at the bottom. – Egor Vasilyev Oct 5 '17 at 19:48
  • :( Sorry, I'm ultra very new at iptables. – Máxima Alekz Oct 5 '17 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.