Is there an easy way to reject all incoming packets except those that come from certain IPs? I can't find any way via iptables or via the GUI provided with CentOS (or another GUI for CentOS) without having to resort to Shorewall. It's fine if the answer is "go with Shorewall". I just didn't want to have to become a Shorewall expert for this really small task.
Any help/advice on this is appreciated. Am I missing an easier way?
Preston
Preston Crawford wrote:
Is there an easy way to reject all incoming packets except those that come from certain IPs? I can't find any way via iptables or via the GUI
See this great iptables example:
http://oceanpark.com/notes/firewall_example.html
In your case it'll be a whole lot simpler, all you'll need are the initial drop rules for all traffic, then a rule or two to allow XYZ ip in.
-te
pseudo:
iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -F INPUT iptables -F OUTPUT iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT # your IPs below iptables -A INPUT -i eth0 -s x.y.z.s/32 -j ACCEPT
On Tue, 2006-01-31 at 16:38 -0800, Troy Engel wrote:
Preston Crawford wrote:
Is there an easy way to reject all incoming packets except those that come from certain IPs? I can't find any way via iptables or via the GUI
See this great iptables example:
http://oceanpark.com/notes/firewall_example.html
In your case it'll be a whole lot simpler, all you'll need are the initial drop rules for all traffic, then a rule or two to allow XYZ ip in.
Thanks!! I'll try that tonight. Or a variation. I just wanted to make sure it was possible and easy mostly, before I started down that path. But you gave me a good start. I appreciate it.
Preston
Preston Crawford wrote:
Is there an easy way to reject all incoming packets except those that come from certain IPs? I can't find any way via iptables or via the GUI
Try the iptables configuration utility firestarter.
On 1/31/06, Preston Crawford preston.crawford@gmail.com wrote:
Is there an easy way to reject all incoming packets except those that come from certain IPs? I can't find any way via iptables or via the GUI provided with CentOS (or another GUI for CentOS) without having to resort to Shorewall. It's fine if the answer is "go with Shorewall". I just didn't want to have to become a Shorewall expert for this really small task.
Any help/advice on this is appreciated. Am I missing an easier way?
Preston
If the only thing you want to do is filter a limited number of IPs, Troy's example will work great. But if you want other features in an easy-to-manage package, it might be worth checking out APF at:
http://www.rfxnetworks.com/apf.php
I have been using it for a while... it has a lot of nice features (rate limiting of some traffic, logging, etc.) and makes it really easy to manage allow lists, block lists, and multiple IP addresses on the box.
I'm not aware of an RPM-based version, but the tarball install sticks everything in /etc/apf, so it's easy to remove if you want to.
Take care, K
-
hkclark＠gmail.com -
Preston Crawford -
ryan -
Troy Engel