Good morning, First I would recommend using different rules for your INPUT and FORWARD chains; it's 100 times easier to troubleshoot and can make things look a lot simpler. Second, I would refrain from posting any external ip addresses on a public forum. I'm not sure about your setup, but usually when you're creating rules such as these, it's a good idea to start off with a default policy of DROP for INPUT, OUTPUT and FORWARD. From a security perspective it's better to block everything and only allow what you're looking for. Anyways, for your rules, I would replace "-A RH-Firewall-1-INPUT -i eth0 -s 82.201.195.123 -j ACCEPT" and "-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j REJECT" with: -A RH-Firewall-1-INPUT -i eth0 -p tcp -m tcp -s ! 82.201.195.123 --dport 22 -j DROP This will drop everything on eth0 going to port 22 from everywhere except the ip address specified. However, it's still easy to spoof an ip address in order to get ssh access to this box. I would really recommend to set all your default policies to DROP though. If you'd like an exhaustive tutorial: http://iptables-tutorial.frozentux.net/iptables-tutorial.html Peace. Andrew Elliott Network Services Computar Services Inc. 2191 Thurston Drive >Ottawa, Ontario K1G 6C9 >Tel: (613) 482-8374 >Fax: (613) 737-3611 >Email: andrewe at computar.ca -----Original Message----- From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On Behalf Of Abd El-Hameed Ayad Sent: Tuesday, May 23, 2006 9:35 AM To: centos at centos.org Subject: [CentOS] iptables rules Hi, I have 2 CentOS servers 82.201.195.123 & 62.139.61.84 I want to deny all ssh logins on port 22 on (62.139.61.84) from any host except from (82.201.195.123) Can anybody tell me such iptables rules to write in /etc/sysconfig/iptables Currently, im using the following rules (on 62.139.61.84) *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Firewall-1-INPUT - [0:0] -A INPUT -j RH-Firewall-1-INPUT -A FORWARD -j RH-Firewall-1-INPUT -A RH-Firewall-1-INPUT -i lo -j ACCEPT -A RH-Firewall-1-INPUT -i eth1 -j ACCEPT -A RH-Firewall-1-INPUT -i eth0 -s 82.201.195.123 -j ACCEPT -A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j REJECT -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A RH-Firewall-1-INPUT -i eth0 -j ACCEPT -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT But i found that somebody is bypassing these rules & trying to authenticate with unknown (or wrong password) accounts Thanx in advance _______________________________________________ CentOS mailing list CentOS at centos.org http://lists.centos.org/mailman/listinfo/centos