0

I have two IP addresses on my physical eth interface. Lets say 192.168.10.7 (eth0:0) and 192.168.0.7 (eth0). So it works. But I use application, working on the only one of this addresses on port 12000. It is setup in this application internally to work on address 192.168.0.7. I set app to work on address 192.168.10.7 too, using iptables, in such way:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -d 192.168.10.7 --dport 12000 -j DNAT --to 192.168.0.7:12000

Now I want to block all incoming traffic to IP address 192.168.10.7 (interface eth0:0) except port 12000. All the rest traffic must be unchanged. I am not iptables expert. Can anybody help me?

1 Answer 1

0

assuming your iptables rule work on the same machine with your application, you have to define a rule to accept incoming and outgoing packet to the address and application port, then you just simply drop everything else, it seems like this :

iptables -A INPUT -p tcp -d 192.168.10.7 --dport 12000 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.10.7 --sport 12000 -j ACCEPT

iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .