LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 08-09-2009, 04:00 PM   #1
billli
LQ Newbie
 
Registered: Aug 2009
Posts: 4

Rep: Reputation: 0
iptables Help


Hi!

I was wondering if someone could help me with iptables.

I have a server and I need to block all IPs except for:
the blocks: 128.96.*.* and 67.215.52.1

This is what I have so far: (at least I think what is correct)

iptables -A INPUT -s ! 128.96.0.0/16 -j DROP
iptables -A INPUT -s 67.215.52.1 -j ACCEPT


There are no other rules in the chain.

Any help would be appreciated.
 
Old 08-09-2009, 04:09 PM   #2
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Welcome to LQ!

Quote:
Originally Posted by billli View Post
I was wondering if someone could help me with iptables.

I have a server and I need to block all IPs except for:
the blocks: 128.96.*.* and 67.215.52.1

This is what I have so far: (at least I think what is correct)

iptables -A INPUT -s ! 128.96.0.0/16 -j DROP
iptables -A INPUT -s 67.215.52.1 -j ACCEPT
Your second rule would never get a chance to work, since the first one would have sent those packets to DROP.

I would suggest this approach instead:
Code:
iptables -A INPUT -s 128.96.0.0/16 -j ACCEPT
iptables -A INPUT -s 67.215.52.1 -j ACCEPT
iptables -A INPUT -j DROP
Of course, you probably want to allow packets on the loopback interface, so:
Code:
iptables -A INPUT -s 128.96.0.0/16 -j ACCEPT
iptables -A INPUT -s 67.215.52.1 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -j DROP

Last edited by win32sux; 08-09-2009 at 04:13 PM.
 
Old 08-09-2009, 11:25 PM   #3
billli
LQ Newbie
 
Registered: Aug 2009
Posts: 4

Original Poster
Rep: Reputation: 0
Oh, I sees!
Thanks! =]

Just on a side note, for my information.

Say is it possible to only allow port 25 be accessed from 128.96.*.* and 67.215.52.1, while all the other port could be accessed by everyone?

Cheers
 
Old 08-10-2009, 07:36 AM   #4
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Quote:
Originally Posted by billli View Post
Say is it possible to only allow port 25 be accessed from 128.96.*.* and 67.215.52.1, while all the other port could be accessed by everyone?
Sure. One way could be like:
Code:
iptables -A INPUT -p TCP --dport ! 25 -s 128.96.0.0/16 -j DROP
iptables -A INPUT -p TCP --dport ! 25 -s 67.215.52.1 -j DROP
iptables -A INPUT -p TCP --dport 25 -j DROP
iptables -A INPUT -j ACCEPT
The last line isn't needed if you have your INPUT policy set to ACCEPT.

My next examples assume the policy is set to ACCEPT.

Another way might me:
Code:
iptables -A INPUT -p TCP --dport 25 -s 128.96.0.0/16 -j ACCEPT
iptables -A INPUT -p TCP --dport 25 -s 67.215.52.1 -j ACCEPT
iptables -A INPUT -s 128.96.0.0/16 -j DROP
iptables -A INPUT -s 67.215.52.1 -j DROP
iptables -A INPUT -p TCP --dport 25 -j DROP
Both examples assume that for those two IPs you only want port 25 to be accessible. In other words, any other ports won't be accessible to those two IPs. If what you meant was that you wanted port 25 to be accessible only to those IPs (while still allowing those two IPs to access any other port) then something like this could be used instead:
Code:
iptables -A INPUT -s 128.96.0.0/16 -j ACCEPT
iptables -A INPUT -s 67.215.52.1 -j ACCEPT
iptables -A INPUT -p TCP --dport 25 -j DROP

Last edited by win32sux; 08-10-2009 at 07:48 AM.
 
  


Reply

Tags
iptables, security


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
An error occured getting IPtables status from the command /etc/rc.d/init.d/iptables s CrazyMAzeY Linux - Newbie 10 08-12-2010 05:25 AM
iptables v1.2.9: Unknown arg `/sbin/iptables' Try `iptables -h' or 'iptables --help' Niceman2005 Linux - Security 4 12-29-2005 08:20 PM
IPtables Log Analyzer from http://www.gege.org/iptables/ brainlego Linux - Software 0 08-11-2003 06:08 AM
iptables book wich one can you pll recomment to be an iptables expert? linuxownt Linux - General 2 06-26-2003 04:38 PM
My iptables script is /etc/sysconfig/iptables. How do i make this baby execute on boo ForumKid Linux - General 3 01-22-2002 07:36 AM


All times are GMT -5. The time now is 03:32 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration