IPTABLES - Allowing nbly a certain IP Address's access to an External Port

[2097]

Ok we are about to allow access to our AD server for a external cloud based application so users can login with the credentials.

 

We use IPCOP as a firewall , and i have set up port forwarding correctly .

 

Basically using IPtables i want to deny access from all external sources to the port (8005) apart from some IP address's i specify ( which are the companys )

 

The only iptable command i have working is

 

/sbin/iptables -I FORWARD -s 213.205.251.213/32 -j DROP

 

This basically just allowed me to block the above external IP from accessing anything on our router .

 

Has any one done this ? and can help me out please.

 

Thanks

2097

[Marci]

Something along the lines of...

 

iptables -I INPUT -p tcp ! -s IP.add.res.s --dport 8005 -j DROP

 

...will only allow the specified IP Address to establish an incoming connection over the specified port. ! is relatively standard for "if what comes after me equates to false".

Edited September 13, 2016 by Marci

[2097]

Something along the lines of...

 

iptables -I INPUT -p tcp ! -s IP.add.res.s --dport 8005 -j DROP

 

...will only allow the specified IP Address to establish an incoming connection over the specified port. ! is relatively standard for "if what comes after me equates to false".

 

Thanks for the reply . Sadly i can only allow 1 ip address via that method ( i need to allow 3 )

 

Also turns out i cant block a forwarded Port ? i need to block on the internal port number.. is that correct ?

 

I am now using

 

/sbin/iptables -I FORWARD -s IPADDRESS -p tcp --dport 389 -j ACCEPT (allows IP's)

 

/sbin/iptables -I FORWARD -s IPADDRESS -p tcp --dport 389 -j ACCEPT (allows IP's)

 

/sbin/iptables -I FORWARD -s IPADDRESS -p tcp --dport 389 -j ACCEPT (allows IP's)

 

/sbin/iptables -I FORWARD -s -p tcp --dport 389 -j DROP ( blocks every ip)

[Marci]

Just use a comma separated list of IPs instead of a single IP...

[2097]

I have tried

 

/sbin/iptables -I FORWARD ! -s IP,IP,IP -p tcp --destination-port 389 -j DROP

 

and it says

 

iptables v1.3.5: host/network `IP,IP' not found

[Marci]

Ah, my mistake. Comma separated doesn't work when ! precedes -s... my bad!

 

/sbin/iptables -I FORWARD -s IP1,IP2,IP3 -p tcp --dport 389 -j ACCEPT

 

...should work tho to condense the first 3 rules into 1.

Edited September 15, 2016 by Marci

[HPlum78]

External access directly on to your AD, surly that is not needed, can this not be done with ADFS? I would tread very carefully opening up direct access to AD from the outside world.

[2097]

External access directly on to your AD, surly that is not needed, can this not be done with ADFS? I would tread very carefully opening up direct access to AD from the outside world.

 

We was planning to do it with via LDAP secure , but there isnt actually a need for it now which is great . But Marci thank you for your help