I am using Debian 8 linux.

I'm trying to block input access to a few ports for most IP addresses, except for a small, select list of IP addresses. I am doing the following, but it does not seem to work:

% sudo /sbin/iptables -v -A INPUT -p tcp -m set '!' --match-set allow-list src -m multiport --dports 110,143,993,995 -j DROP

Whenever there is an access attempt to any of those ports from an IP address that is not in allow-list, that attempt is still succeeding.

These are the first few lines of allow-list:

% sudo /sbin/ipset list allow-list
Name: allow-list
Type: hash:net
Revision: 6
Header: family inet hashsize 16384 maxelem 262144
Size in memory: 687888
References: 2
[ ... more CIDR entries ... ]

And this is the current iptables configuration:

% sudo /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  anywhere             anywhere             ! match-set allow-list src multiport dports pop3,imap2,imaps,pop3s

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

What am I doing incorrectly?

Thank you very much in advance.


1 Answer 1


I now realize what I was doing incorrectly. The following fix works for me:

% sudo /sbin/iptables -v -I INPUT -p tcp -m multiport --dports 110,143,993,995                                   -j DROP
% sudo /sbin/iptables -v -I INPUT -p tcp -m multiport --dports 110,143,993,995 -m set --match-set allow-list src -j ALLOW

In other words, first allow the IP's in allow-list to access via the port list, and then drop all other IP's who try to access via that port list.

Also, I had originally left out the -p tcp option, which is needed when dealing with TCP ports.

UPDATE: Originally, I incorrectly used -A INPUT above. I have changed it to the correct -I INPUT.

FURTHER UPDATE: ... and with -I, I had to change the of the rules: DROP needs to be defined before ALLOW in this case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.