How to Deny/Allow IP’s Using iptables

Janeiro 30th, 2018

This article explains how to add iptables firewall rules using the “iptables -A” (append) command. Iptables is a rule-based firewall, which will process each rule in order until it finds one that matches. The iptables utility is typically pre-installed on your linux distribution, but isn’t actually running any rules.

Blocking a Single IP Address

You can block an IP by using the -s parameter, replacing xx.xx.xx.xx with the address that you are trying to block.

• iptables -A INPUT -s xx.xx.xx.xx -j DROP

Block an IP for a Specific Port

You can block a port entirely from being accessed over from an IP by using the the –dport switch and adding the port of the service you want to block. Where, xx.xx.xx.xx is the remote IP address and PORT is the port number you wish to deny access to.

• iptables -A INPUT -p tcp -s xx.xx.xx.xx –dport PORT -j DROP

Allowing a Single IP Address

You can allow an IP by using the -s parameter and using the policy ACCEPT, replacing xx.xx.xx.xx with the address that you are granting access.

• iptables -A INPUT -s xx.xx.xx.xx -j ACCEPT

Allowing a Single Port from a Single IP

You can add the -s command along with the –dport command to further limit the rule to a specific port.

• iptables -A INPUT -p tcp -s xx.xx.xx.xx –dport PORT -j ACCEPT

How to Block a Scanner on Your Server

You can block a scanner on your server, for example “foobar.at.ISC.SANS”, using a string.

• iptables -I INPUT -p tcp –dport 80 -m string –algo bm \
  –string ‘GET /foobar.at.ISC.SANS.’ -j DROP

Viewing the Current Rules

You can view the current rules using the following command:

• iptables -L

Clearing the Current Rules

You can clear out all the current rules by using the flush parameter. This is very useful if you need to put the rules in the correct order, or when you are testing.

• iptables –flush