I have a linux machine without iptables running and we have a new requirement to block a remote machine ( IP = 172.1.1.1 ) completely accessing our linux machine in both directions. So I need to allow "everything" except that IP address. So i tried below:
If I set the below in /etc/sysconfig/iptables file and do service iptables restart then everything is allowed (included the blocked IP)
Code:
# Default IPtables config
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [26:8868]
-A INPUT -j ACCEPT
-A OUTPUT -j ACCEPT
-A INPUT --src 172.1.1.1 -j REJECT
-A OUTPUT --dst 172.1.1.1 -j REJECT
COMMIT
If I try the below then it blocks everything
Code:
# Default IPtables config
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [26:8868]
-A INPUT --src 172.1.1.1 -j REJECT
-A OUTPUT --dst 172.1.1.1 -j REJECT
-A INPUT -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT
I'm new to iptables and not sure what am I doing wrong, appreciate if any expert could help me out here please
I have 2 LAN's, seperated by a firewall, running iptables on it.
I want only allow ftp access from one to the other LAN.
Server 1 in LAN 1 should have ftp access to Server 2 in LAN 2
Server 2 in LAN 2 should not have ftp access to Server 1 in LAN 1.
Can someone tell me how to set up the... (5 Replies)
Hi
I am looking to block an incomming IP for all the subnet in lab area. Only single Ip from Lab should be access to this incomming IP.
Block IP=10.20.50.xx
Subnet=10.30.40.xx
............................
...........................
Subnet=10.40.50.xx
can anyone explain how to do... (2 Replies)
Discussion started by: boby.kumar
2 Replies
LEARN ABOUT MOJAVE
iptables-save
IPTABLES-SAVE(8) iptables 1.6.1 IPTABLES-SAVE(8)NAME
iptables-save -- dump iptables rules to stdout
ip6tables-save -- dump iptables rules to stdout
SYNOPSIS
iptables-save [-M modprobe] [-c] [-t table]
ip6tables-save [-M modprobe] [-c] [-t table]
DESCRIPTION
iptables-save and ip6tables-save are used to dump the contents of IP or IPv6 Table in easily parseable format to STDOUT. Use I/O-redirect-
ion provided by your shell to write to a file.
-M, --modprobe modprobe_program
Specify the path to the modprobe program. By default, iptables-save will inspect /proc/sys/kernel/modprobe to determine the exe-
cutable's path.
-c, --counters
include the current values of all packet and byte counters in the output
-t, --table tablename
restrict output to only one table. If not specified, output includes all available tables.
BUGS
None known as of iptables-1.2.1 release
AUTHORS
Harald Welte <laforge@gnumonks.org>
Rusty Russell <rusty@rustcorp.com.au>
Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-save.
SEE ALSO iptables-apply(8),iptables-restore(8), iptables(8)
The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, which details NAT, and the netfilter-hacking-HOWTO which details the
internals.
iptables 1.6.1 IPTABLES-SAVE(8)
10-21-2015
