Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I block all ports except

  1. ssh (port 22)
  2. httpd (port 80)

using iptables and iphains?

share|improve this question
    
While ochach's answer is technically correct, I think you need to clarify your question. Do you mean "block all input except ssh and http"? If you follow ochach's answer, you won't be able to do anything - no data will be allowed out of your box. –  baumgart Jun 15 '10 at 15:37
add comment

migrated from stackoverflow.com Jun 15 '10 at 15:17

This question came from our site for professional and enthusiast programmers.

2 Answers

Ipchains are old and i do not reccomend it

simple script

#!/bin/bash
IPTABLES=/sbin/iptables

#start and flush
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -X
$IPTABLES -P FORWARD DROP
$IPTABLES -P INPUT   DROP
$IPTABLES -P OUTPUT  ACCEPT

#SSH traffic
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
#HTTP traffic
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT

#loopback
iptables -A INPUT -i lo -p all -j ACCEPT
share|improve this answer
2  
I ran this script on my server and locked myself out :) –  Zilupe Apr 23 '12 at 22:45
2  
@Zilupe to easily not loose acces to server remember to use cron while editing firewall - like: */2 * * * * iptables -P INPUT ACCEPT –  ochach May 28 '12 at 10:04
add comment

Which Linux distribution? You may be better off using a higher level firewall like ufw:

As root/sudo: ufw default deny ufw allow ssh ufw allow http ufw enable

share|improve this answer
    
This is a worthwhile option but consider providing instructions on how to block all incoming traffic except ssh and http, please. –  Jeremy W May 30 '12 at 3:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.