I am trying to only allow certain IPs to access port 8209. I have tried a few different methods that I read on ServerFault. This method is the most recent one I have tried.
I manually edited my configuration file by adding follow lines:
-N xxx # create a new chain
-A xxx --src 50.88.183.6 -j ACCEPT # allow 20.88.183.6
-A xxx --src 97.68.205.177 -j ACCEPT # allow 87.68.205.177
-A xxx --src 38.103.14.231 -j ACCEPT # allow 49.103.14.231
-A xxx -j DROP # drop everyone else
-I INPUT -m tcp -p tcp --dport 8209 -j xxx # use chain xxx for packets coming to TCP port 8209
After adding the lines, I restarted Iptables and it did not work, I could still access it from any IP. I am not sure if it is just the wrong configuration or placement in the files matters.
Incase placement in the file matters, I placed it near the top of the configuration directly below these lines
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [302211:210610546]
:RH-Firewall-1-INPUT - [0:0]
:acctboth - [0:0]
:cP-Firewall-1-INPUT - [0:0]
And above this line:
-A INPUT -p tcp -m tcp --dport 49152:65534 -j ACCEPT
-A INPUT -j cP-Firewall-1-INPUT
-A INPUT -j acctboth
-A INPUT -j RH-Firewall-1-INPUT
Here is the output for command iptables -L -n -v
Chain INPUT (policy ACCEPT 63019 packets, 7491K bytes)
pkts bytes target prot opt in out source destination
60060 6425K acctboth all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 44033 packets, 85M bytes)
pkts bytes target prot opt in out source destination
41960 82M acctboth all -- * * 0.0.0.0/0 0.0.0.0/0
Chain acctboth (2 references)
pkts bytes target prot opt in out source destination
0 0 tcp -- !lo * 23.253.74.239 0.0.0.0/0 tcp dpt:80
0 0 tcp -- !lo * 0.0.0.0/0 23.253.74.239 tcp spt:80
0 0 tcp -- !lo * 23.253.74.239 0.0.0.0/0 tcp dpt:25
0 0 tcp -- !lo * 0.0.0.0/0 23.253.74.239 tcp spt:25
0 0 tcp -- !lo * 23.253.74.239 0.0.0.0/0 tcp dpt:110
0 0 tcp -- !lo * 0.0.0.0/0 23.253.74.239 tcp spt:110
0 0 icmp -- !lo * 23.253.74.239 0.0.0.0/0
0 0 icmp -- !lo * 0.0.0.0/0 23.253.74.239
2 216 tcp -- !lo * 23.253.74.239 0.0.0.0/0
3 268 tcp -- !lo * 0.0.0.0/0 23.253.74.239
0 0 udp -- !lo * 23.253.74.239 0.0.0.0/0
0 0 udp -- !lo * 0.0.0.0/0 23.253.74.239
2 216 all -- !lo * 23.253.74.239 0.0.0.0/0
3 268 all -- !lo * 0.0.0.0/0 23.253.74.239
0 0 tcp -- !lo * 23.253.72.112 0.0.0.0/0 tcp dpt:80
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.112 tcp spt:80
0 0 tcp -- !lo * 23.253.72.112 0.0.0.0/0 tcp dpt:25
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.112 tcp spt:25
0 0 tcp -- !lo * 23.253.72.112 0.0.0.0/0 tcp dpt:110
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.112 tcp spt:110
0 0 icmp -- !lo * 23.253.72.112 0.0.0.0/0
0 0 icmp -- !lo * 0.0.0.0/0 23.253.72.112
0 0 tcp -- !lo * 23.253.72.112 0.0.0.0/0
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.112
0 0 udp -- !lo * 23.253.72.112 0.0.0.0/0
0 0 udp -- !lo * 0.0.0.0/0 23.253.72.112
0 0 all -- !lo * 23.253.72.112 0.0.0.0/0
0 0 all -- !lo * 0.0.0.0/0 23.253.72.112
0 0 tcp -- !lo * 23.253.72.149 0.0.0.0/0 tcp dpt:80
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.149 tcp spt:80
0 0 tcp -- !lo * 23.253.72.149 0.0.0.0/0 tcp dpt:25
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.149 tcp spt:25
0 0 tcp -- !lo * 23.253.72.149 0.0.0.0/0 tcp dpt:110
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.149 tcp spt:110
0 0 icmp -- !lo * 23.253.72.149 0.0.0.0/0
0 0 icmp -- !lo * 0.0.0.0/0 23.253.72.149
0 0 tcp -- !lo * 23.253.72.149 0.0.0.0/0
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.149
0 0 udp -- !lo * 23.253.72.149 0.0.0.0/0
0 0 udp -- !lo * 0.0.0.0/0 23.253.72.149
0 0 all -- !lo * 23.253.72.149 0.0.0.0/0
0 0 all -- !lo * 0.0.0.0/0 23.253.72.149
0 0 tcp -- !lo * 23.253.72.81 0.0.0.0/0 tcp dpt:80
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.81 tcp spt:80
0 0 tcp -- !lo * 23.253.72.81 0.0.0.0/0 tcp dpt:25
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.81 tcp spt:25
0 0 tcp -- !lo * 23.253.72.81 0.0.0.0/0 tcp dpt:110
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.81 tcp spt:110
0 0 icmp -- !lo * 23.253.72.81 0.0.0.0/0
0 0 icmp -- !lo * 0.0.0.0/0 23.253.72.81
0 0 tcp -- !lo * 23.253.72.81 0.0.0.0/0
0 0 tcp -- !lo * 0.0.0.0/0 23.253.72.81
0 0 udp -- !lo * 23.253.72.81 0.0.0.0/0
0 0 udp -- !lo * 0.0.0.0/0 23.253.72.81
0 0 all -- !lo * 23.253.72.81 0.0.0.0/0
0 0 all -- !lo * 0.0.0.0/0 23.253.72.81
0 0 tcp -- !lo * 10.208.37.124 0.0.0.0/0 tcp dpt:80
0 0 tcp -- !lo * 0.0.0.0/0 10.208.37.124 tcp spt:80
0 0 tcp -- !lo * 10.208.37.124 0.0.0.0/0 tcp dpt:25
0 0 tcp -- !lo * 0.0.0.0/0 10.208.37.124 tcp spt:25
0 0 tcp -- !lo * 10.208.37.124 0.0.0.0/0 tcp dpt:110
0 0 tcp -- !lo * 0.0.0.0/0 10.208.37.124 tcp spt:110
0 0 icmp -- !lo * 10.208.37.124 0.0.0.0/0
0 0 icmp -- !lo * 0.0.0.0/0 10.208.37.124
0 0 tcp -- !lo * 10.208.37.124 0.0.0.0/0
0 0 tcp -- !lo * 0.0.0.0/0 10.208.37.124
0 0 udp -- !lo * 10.208.37.124 0.0.0.0/0
0 0 udp -- !lo * 0.0.0.0/0 10.208.37.124
0 0 all -- !lo * 10.208.37.124 0.0.0.0/0
0 0 all -- !lo * 0.0.0.0/0 10.208.37.124
5 484 all -- !lo * 0.0.0.0/0 0.0.0.0/0
Here is the full output of the configuration:
# Generated by iptables-save v1.3.5 on Wed Jan 8 20:49:24 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [302211:210610546]
:RH-Firewall-1-INPUT - [0:0]
:acctboth - [0:0]
:cP-Firewall-1-INPUT - [0:0]
-N xxx # create a new chain
-A xxx --src 50.88.183.6 -j ACCEPT # allow 20.88.183.6
-A xxx --src 97.68.205.177 -j ACCEPT # allow 87.68.205.177
-A xxx --src 38.103.14.231 -j ACCEPT # allow 39.103.14.231
-A xxx -j DROP # drop everyone else
-I INPUT -m tcp -p tcp --dport 8209 -j xxx # use chain xxx for packets coming to TCP port 8209
-A INPUT -p tcp -s 20.88.183.6 -j ACCEPT
-A INPUT -p tcp -s 87.68.205.177 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 49152:65534 -j ACCEPT
-A INPUT -j cP-Firewall-1-INPUT
-A INPUT -j acctboth
-A INPUT -j RH-Firewall-1-INPUT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -s 220.177.198.26 -j DROP
-A INPUT -p tcp -s 115.239.248.121 -j DROP
-A INPUT -p tcp -s 222.186.56.33 -j DROP
-A FORWARD -j cP-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A OUTPUT -j acctboth
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8209 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A acctboth -s 23.253.74.239 -i ! lo -p tcp -m tcp --dport 80
-A acctboth -d 23.253.74.239 -i ! lo -p tcp -m tcp --sport 80
-A acctboth -s 23.253.74.239 -i ! lo -p tcp -m tcp --dport 25
-A acctboth -d 23.253.74.239 -i ! lo -p tcp -m tcp --sport 25
-A acctboth -s 23.253.74.239 -i ! lo -p tcp -m tcp --dport 110
-A acctboth -d 23.253.74.239 -i ! lo -p tcp -m tcp --sport 110
-A acctboth -s 23.253.74.239 -i ! lo -p icmp
-A acctboth -d 23.253.74.239 -i ! lo -p icmp
-A acctboth -s 23.253.74.239 -i ! lo -p tcp
-A acctboth -d 23.253.74.239 -i ! lo -p tcp
-A acctboth -s 23.253.74.239 -i ! lo -p udp
-A acctboth -d 23.253.74.239 -i ! lo -p udp
-A acctboth -s 23.253.74.239 -i ! lo
-A acctboth -d 23.253.74.239 -i ! lo
-A acctboth -s 10.208.37.124 -i ! lo -p tcp -m tcp --dport 80
-A acctboth -d 10.208.37.124 -i ! lo -p tcp -m tcp --sport 80
-A acctboth -s 10.208.37.124 -i ! lo -p tcp -m tcp --dport 25
-A acctboth -d 10.208.37.124 -i ! lo -p tcp -m tcp --sport 25
-A acctboth -s 10.208.37.124 -i ! lo -p tcp -m tcp --dport 110
-A acctboth -d 10.208.37.124 -i ! lo -p tcp -m tcp --sport 110
-A acctboth -s 10.208.37.124 -i ! lo -p icmp
-A acctboth -d 10.208.37.124 -i ! lo -p icmp
-A acctboth -s 10.208.37.124 -i ! lo -p tcp
-A acctboth -d 10.208.37.124 -i ! lo -p tcp
-A acctboth -s 10.208.37.124 -i ! lo -p udp
-A acctboth -d 10.208.37.124 -i ! lo -p udp
-A acctboth -s 10.208.37.124 -i ! lo
-A acctboth -d 10.208.37.124 -i ! lo
-A acctboth -i ! lo
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2078 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2082 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2077 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 26 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8209 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2086 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2087 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2095 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2096 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
-A cP-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2083 -j ACCEPT
-A cP-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
COMMIT
# Completed on Wed Jan 8 20:49:24 2014
# Generated by iptables-save v1.3.5 on Wed Jan 8 20:49:24 2014
*nat
:PREROUTING ACCEPT [10751:641344]
:POSTROUTING ACCEPT [6174:435114]
:OUTPUT ACCEPT [6174:435114]
COMMIT