3

I require a configuration of iptables file which will allow me connection through only specific ip-address say 10.0.0.1 on all port ranging from 0-5555 and deny all other ip-addresses?

I have tried varies iptables command option but it didn't worked properly. What will be the exact iptables command?

Edit: Ubuntu 14.04 LTS

2
  • Did you checked this ? help.ubuntu.com/community/IptablesHowTo Also provide Ubuntu version you are using Aug 7, 2015 at 9:08
  • I have tried this one: iptables -A INPUT -p tcp -s 10.0.0.1 --dport 0:5555 -j ACCEPT by reading documentation and googling. But it didn't worked. After flushing, saving didn't worked also.
    – snoop
    Aug 7, 2015 at 9:15

1 Answer 1

2

Code is something like this

#################################################
# clear existing chains
#################################################

iptables --flush
iptables --delete-chain

#################################################
# allow loopback
#################################################

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#################################################
# allow established connections
#################################################

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#################################################
# allow ICMP from 10.0.0.1
#################################################

iptables -A INPUT -s 10.0.0.1 -p icmp --icmp-type any -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT


#################################################
# allow port range from 10.0.0.1
#################################################

iptables -A INPUT -m state --state NEW -s 10.0.0.1 -m tcp -p tcp --match multiport --dports 0:5555 -j ACCEPT

#################################################
# deny all
#################################################

iptables -A INPUT -j DROP

#################################################
# default policies
#################################################

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

#################################################
# save the new policy
#################################################

service iptables save
8
  • Thanks, This really worked! Further to this I need to allow icmp ping to that IP only. Where should I do changes for this?
    – snoop
    Aug 7, 2015 at 12:43
  • I add icmp code
    – 2707974
    Aug 7, 2015 at 12:47
  • For outgoing and incoming https traffic should I add these additional rules? iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
    – snoop
    Aug 14, 2015 at 8:56
  • Only for output iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT When site return traffic to you aka make session use random port. But iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT will allowe you communication.
    – 2707974
    Aug 14, 2015 at 9:04
  • Suppose I need to allow internet connection to same IP address (10.0.0.1) then what changes I need to do in this script or by default this will allow internet connection also.?
    – snoop
    Aug 21, 2015 at 6:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .