I want this behaviour:

All outside computers can only bind to my server's ports 22(ssh), 80(http) and 443(https).

However all localhost apps can bind to any port they want.

I have search and this is what I came up with:

iptables -A INPUT -p tcp -m tcp -m multiport ! --dports 22,80,443 -j DROP

It does what I want, but blocks to all localhost apps as well. What should I change there to enable localhost apps bind to any port?

And then how can I make the rule permanent?


  • been a while but what if you add -s ?
    – barlop
    Apr 2, 2018 at 12:15
  • won't that just apply this rule to localhost connections? i.e. only localhost connections will get blocked on all ports but those 3?
    – PedroD
    Apr 2, 2018 at 12:19
  • I guess I meant it more in the way like timmy did it. on an accept line.
    – barlop
    Apr 2, 2018 at 16:12

1 Answer 1


Rules are matched in order. Make one to allow for localhost ahead of the one to deny.

iptables -A INPUT -p tcp -s localhost -m tcp -m multiport ! --dports 22,80,443 -j ACCEPT

iptables -A INPUT -p tcp -m tcp -m multiport ! --dports 22,80,443 -j DROP

Read here for how to save them depending on your OS. https://www.thomas-krenn.com/en/wiki/Saving_Iptables_Firewall_Rules_Permanently

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .