How can I block all ports except 22,80,443 to all incoming traffic except localhost?

Question

I want this behaviour:

All outside computers can only bind to my server's ports 22(ssh), 80(http) and 443(https).

However all localhost apps can bind to any port they want.

I have search and this is what I came up with:

iptables -A INPUT -p tcp -m tcp -m multiport ! --dports 22,80,443 -j DROP

It does what I want, but blocks to all localhost apps as well. What should I change there to enable localhost apps bind to any port?

And then how can I make the rule permanent?

Thanks!

won't that just apply this rule to localhost connections? i.e. only localhost connections will get blocked on all ports but those 3? — PedroD, Apr 2, 2018 at 12:19
I guess I meant it more in the way like timmy did it. on an accept line. — barlop, Apr 2, 2018 at 16:12

Timmy Browne · Accepted Answer · 2018-04-02 15:38:20Z

1

Rules are matched in order. Make one to allow for localhost ahead of the one to deny.

iptables -A INPUT -p tcp -s localhost -m tcp -m multiport ! --dports 22,80,443 -j ACCEPT

iptables -A INPUT -p tcp -m tcp -m multiport ! --dports 22,80,443 -j DROP

answered Apr 2, 2018 at 15:38

Timmy Browne

6553 silver badges11 bronze badges

Add a comment |

1 Answer 1