Allowing only certain hosts / domains while blocking the rest using IPTables?

lolmannz · 10-18-2008, 07:02 AM

Hi there, I'm just wondering how would one allow outgoing / incoming traffic from specific IP/domain range while blocking the rest using IPtables or similar firewalls?

Some examples of the rules would be high appreciated.
Thanks in advance

blackhole54 · 10-18-2008, 05:55 PM

iptables is quite flexible so you can do almost anything. But the simplest thing would be to enumerate what you want to allow and either DROP or REJECT the rest. One example for the OUTPUT chain (for outgoing connections) would be:

Code:

iptables -F OUTPUT
iptables -P OUTPUT REJECT

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -d 12.34.56.78 -j ACCEPT
iptables -A OUTPUT -d 87.65.43.21 -j ACCEPT
iptables -A OUTPUT -d 123.45.0.0/16 -j ACCEPT

You should always allow loop back (-i lo). The above code also accepts packets destined for the two enumerated IP addresses and the one network range. Everything else will be REJECTed by policy (-P).

win32sux · 10-19-2008, 12:16 PM

Quote:

Originally Posted by lolmannz

Hi there, I'm just wondering how would one allow outgoing / incoming traffic from specific IP/domain range while blocking the rest using IPtables or similar firewalls?

Some examples of the rules would be high appreciated.
Thanks in advance

You could achieve this by executing a single command such as, for example:

Code:

iptables -I INPUT -i eth0 -m iprange ! --src-range 217.98.46.100-217.98.56.235 -j DROP

After executing that command, any packets which hit the eth0 interface and don't have a source address between 217.98.46.100 and 217.98.56.235 will be filtered.