iptables rules to close port

Sushy · 10-23-2006, 08:25 AM

hi!

I need to close port 25 for connections from LAN (192.168.0.0/24), except for ip 192.168.0.1 which is router and is interface for postfix. So I need so that user can send mails only via 192.168.0.1

So can please somebody tell me the iptables rules which reject all connections from 192.168.0.0/24 to port 25, except 192.168.0.1

Thanks.
S.

b0uncer · 10-23-2006, 10:56 AM

I think iptables handles the rules in the order they're fed to it (could be vice versa, but I think it's this way). So, following that, first create a rule that allows that one ip address have a connection to the port you specified, second create a rule that denies the IPs from connecting to it. I think that should work.

The rules would be something like:

Code:

/sbin/iptables -A INPUT -s 192.168.0.1 --dport 25 -j ACCEPT
/sbin/iptables -A INPUT -s 192.168.0.0/24 --dport 25 -j ACCEPT

Since I can't test them myself, I won't guarantee they'll work but that's how I'd start trying

mossy · 10-23-2006, 12:25 PM

Quote:

Originally Posted by b0uncer

I think iptables handles the rules in the order they're fed to it (could be vice versa, but I think it's this way). So, following that, first create a rule that allows that one ip address have a connection to the port you specified, second create a rule that denies the IPs from connecting to it. I think that should work.

The rules would be something like:

Code:

/sbin/iptables -A INPUT -s 192.168.0.1 --dport 25 -j ACCEPT
/sbin/iptables -A INPUT -s 192.168.0.0/24 --dport 25 -j ACCEPT

Since I can't test them myself, I won't guarantee they'll work but that's how I'd start trying

Yes it does do it in order.

Code:

/sbin/iptables -A INPUT -s 192.168.0.1 --dport 25 -j ACCEPT

will allow port 25 traffic from 192.168.0.1

Code:

/sbin/iptables -A INPUT -s 192.168.0.0/24 --dport 25 -j ACCEPT

This is incorrect and should read DROP at the end:

Code:

/sbin/iptables -A INPUT -s 192.168.0.0/24 --dport 25 -j DROP

This will drop all traffic coming from any IP on the /24 on port 25. At this point port 25 traffic from 192.168.0.1 will have passed already when it matched exactly.

Test them for accuracy.
If all else fails:

Code:

man iptables