Access One Ip Address

**vern** · 07-15-2005

I am running Mandriva 10.3.
What is the simplest way to set up the machine so the web browsers will only access one specific IP address and no others? What I guess I need to know is can I block all of port 80 using IPTables, but leave it open for only one IP address, and how do I do that. Or is another firewall easier to do this with.

**borromini** · 07-15-2005

Configure IPtables to accept output
- on port 80
- going to the ip address you have in mind

and set the default policy to 'DROP', and make sure all outgoing connections are blocked (you will have to add an explicit rule for this I presume). The rule allowing outgoing traffic over port 80, to the specific IP, will overrule the general one (in that specific case only).

Do some reading about IPtables, the syntax is not that difficult

.

After editing the configuration, restart the service to see if it detects any syntax errors.

**vern** · 07-15-2005

I must be doing something wrong. Here is my configuration.

Code:

# Generated by iptables-save v1.2.9 on Fri Jul 15 14&#58;32&#58;03 2005
*filter
&#58;FORWARD ACCEPT &#91;0&#58;0&#93;
&#58;INPUT ACCEPT &#91;0&#58;0&#93;
&#58;OUTPUT DROP &#91;0&#58;0&#93;
-A OUTPUT -p tcp -m tcp -d 1x1.1x7.1xx.x73 --dport 80 -j ACCEPT
COMMIT
# Completed on Fri Jul 15 14&#58;32&#58;03 2005
# Generated by iptables-save v1.2.9 on Fri Jul 15 14&#58;32&#58;03 2005
*nat
&#58;PREROUTING ACCEPT &#91;0&#58;0&#93;
&#58;POSTROUTING ACCEPT &#91;0&#58;0&#93;
&#58;OUTPUT ACCEPT &#91;0&#58;0&#93;
COMMIT
# Completed on Fri Jul 15 14&#58;32&#58;03 2005
# Generated by iptables-save v1.2.9 on Fri Jul 15 14&#58;32&#58;03 2005
*mangle
&#58;PREROUTING ACCEPT &#91;0&#58;0&#93;
&#58;INPUT ACCEPT &#91;0&#58;0&#93;
&#58;FORWARD ACCEPT &#91;0&#58;0&#93;
&#58;OUTPUT ACCEPT &#91;0&#58;0&#93;
&#58;POSTROUTING ACCEPT &#91;0&#58;0&#93;
COMMIT
# Completed on Fri Jul 15 14&#58;32&#58;03 2005

All sites are block including the one I want access to. (The "x" are inplace of numbers)
Does anyone see my errror?

Found my error, the line should read:

Code:

-A OUTPUT -p tcp -d 1x1.1x7.1xx.x73 --dport 80 -j ACCEPT

Thank you borromini for pointing me in the right direction.

**borromini** · 07-15-2005

No problem, I hope it works

. Once you get the syntax, it's easy to configure! You just need to do the reading first, and that can be a challenge

.

Thread Tools

Display

Access One Ip Address

Posting Permissions