How can I stop telnet access for a particular IP address on the command line?

  • 3
    Emphatically: telnet is an open security sore and a breach waiting to happen. Disable all telnet servers ASAP. – Deer Hunter Dec 4 '12 at 9:55
  • telnet to what port? Don`t tell us, that you are using a telnet-server! – Nils Dec 5 '12 at 21:48

A more general solution than Laurentiu Roescu's would be to use iptables, which works the same in every distribution and essentially regardless of which software is installed.

# iptables -A INPUT -p tcp -s <ip_address> --dport telnet -j DROP

You may optionally use -j REJECT instead of -j DROP. Using REJECT will tell whoever is at the other end that there is nothing on that particular port; using DROP will drop the packet, which leads to the connection attempt timing out after the remote host's connect timeout interval has passed.

It's possible that you will need to insert the rule before any "ACCEPT" rules that may already be in place. If so, I like to do it like this:

# iptables -L INPUT --line-number
<some or lots of output>
# iptables -I INPUT <number of telnet accept rule> ...

where the ... is everything from -p tcp onward in the command above. Essentially, -I INPUT n replaces -A INPUT. (-I is insert just before position n, -A is append.)

You can use --dport telnet because telnet is listed in /etc/services. Try grep telnet /etc/services if you are curious. If it weren't, you'd have to use the numerical port number, which is 23.

You may need to use something like iptables-save to preserve the rule across reboots. The details on that will depend on your distribution and setup, and thus cannot be answered generally. If you specify your distribution and version, someone may be able to offer specific insights as to that (or it may work better as a separate question "how do I preserve iptables rules across reboots in Distribution X Version Y?").

That said, I agree with that one should use SSH instead. But you still may want to block access from certain IPs, and the lower level at which that can be done, the less you risk a bug in a higher-level portion of the stack leading to a compromise or denial of service.


In /etc/host.deny add:

telnet: <ip_addres>

But you should use ssh instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.