0

I'm using linux mint and I want to block all incoming connections on port 5210 except 3 IPs. I've searched and went through a lot of threads, and found only results allowing just ranges of LAN IPs, and I cannot find anything related to allowing exactly 3 different IPs that are not in the LAN.

How should I do this or what should I search for?

0

Allow the three, reject/drop the rest. With iptables from the command line:

iptables -A INPUT -p tcp --dport 5210 --source "$addr1" -j ACCEPT
iptables -A INPUT -p tcp --dport 5210 --source "$addr2" -j ACCEPT
iptables -A INPUT -p tcp --dport 5210 --source "$addr3" -j ACCEPT
iptables -A INPUT -p tcp --dport 5210 -j REJECT

For, e.g. addr2, the first rule does not match, and it's ignored, while the second rule matches and accepts the packet.

Or, make a chain that does nothing for the three addresses and rejects the rest, then accept or do any further processing in the upper level:

iptables -N p5210
iptables -A p5210 --source "$addr1" -j RETURN
iptables -A p5210 --source "$addr2" -j RETURN
iptables -A p5210 --source "$addr3" -j RETURN
iptables -A p5210 -j REJECT

iptables -A INPUT -p tcp --dport 5210 -j p5210
# add whatever further limitations you want
iptables -A INPUT -p tcp --dport 5210 -j ACCEPT 

Of course, putting the addresses in a variable and using a loop to run the same command for all of them is also an option:

#!/bin/bash
allowed_addresses=(1.2.3.4 4.5.6.7 7.8.9.0)
for addr in "${allowed_addresses[@]}" ; do 
    iptables -A INPUT -p tcp --dport 5210 --source "$addr" -j ACCEPT
done
  • Thanks a lot, the first one was the one I was looking for, I didn't know I should add them one by one. – unkn0wnx Mar 14 '18 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.