topic Re: IPTABLES in Operating System - Linux

IPTABLES

Jonathan Morrison — Sun, 04 Apr 2010 11:40:39 GMT

Could anyone point me to a good IPTABLES protocol to reject all incoming traffic except for a single IP or IP range?

Thanks,

Jonathan.

Re: IPTABLES

Steven E. Protter — Sun, 04 Apr 2010 13:49:26 GMT

Shalom Jonathan,

Here is a good tutorial.
http://www.cyberciti.biz/tips/linux-iptables-how-to-specify-a-range-of-ip-addresses-or-ports.html

SEO

Re: IPTABLES

Jonathan Morrison — Sun, 04 Apr 2010 16:22:43 GMT

Thanks for the link, I have read the tutorial but I thought there was more to it than simply running something like:

iptables -A INPUT -p tcp --destination-port 22 -m iprange --src-range 192.168.1.100-192.168.1.200 -j ACCEPT

At the command prompt. Is there no 'DROP everything else' also nededed?

Ta,

Jon.

Re: IPTABLES

J. Maestre — Mon, 05 Apr 2010 08:32:04 GMT

Before setting up specific rules you should configure a default rule for each chain (it might be set already, check with "iptables -L INPUT").

To set a default DROP rule for INPUT:

iptables -P INPUT DROP

Re: IPTABLES

loco_vikide — Mon, 05 Apr 2010 15:41:17 GMT

You might want to do something similar to this:

:INPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 22 -s 192.168.0.0/24 -j ACCEPT
-A INPUT -p tcp -m state --state ESTABLISHED,RELATED --dport 22 -s 192.168.0.0/24 -j ACCEPT

You could substitute the range of IPs with a specific IP address.

Cheers