From: Grant Taylor <gtaylor@riverviewtech.net>
To: Mail List - Netfilter <netfilter@lists.netfilter.org>
Subject: Re: blocking access to port 22 when INPUT policy is ACCEPT
Date: Tue, 31 Jul 2007 18:51:26 -0500 [thread overview]
Message-ID: <46AFCAFE.4030003@riverviewtech.net> (raw)
In-Reply-To: <b400c69a0707311504g653c5bcdv86f100f5278a8fda@mail.gmail.com>
On 7/31/2007 5:04 PM, Maxim Veksler wrote:
> I have my machine configured to allow all traffic in INPUT table, but
> I would like to block access to port tcp22 from all besides several
> ip's.
*nod*
> How can I do a "AND" between them as in
Wrong logic operator. The question could also be written as "How do I
block all connections not from the set A or B or C or ...". One way to
achieve this is with the IPSet match extension (which I have not worked
with, so this may not be syntactically correct).
iptables -A INPUT ! -m set --set sshclients src -j DROP
In theory this rule will say "if the source ip is not in set sshclients
DROP the packet".
This will allow you to use the user space utility ipset to control your
(iphash) set which is your list of allowed ssh clients.
Grant. . . .
next prev parent reply other threads:[~2007-07-31 23:51 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <b400c69a0707311002j46a9505du414c2058edbe79e2@mail.gmail.com>
2007-07-31 22:04 ` blocking access to port 22 when INPUT policy is ACCEPT Maxim Veksler
2007-07-31 22:18 ` Maximilian Wilhelm
2007-07-31 23:40 ` Grant Taylor
2007-08-01 13:28 ` Maximilian Wilhelm
2007-07-31 23:51 ` Grant Taylor [this message]
[not found] <200708010731.l717Vte0020939@mail3.jubileegroup.co.uk>
2007-08-01 8:30 ` G.W. Haywood
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=46AFCAFE.4030003@riverviewtech.net \
--to=gtaylor@riverviewtech.net \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox