I disable firewall like so:#!/bin/bashiptables -Fiptables -Xiptables -P INPUT ACCEPTiptables -P OUTPUT ACCEPTiptables -P FORWARD ACCEPTUpdateI also enable my firewall: #!/bin/bashssh=x.x.x.xhttp='x.x.x.x y.y.y.y'# Clear any previous rules.iptables -F# Default drop policy.iptables -P INPUT DROPiptables -P OUTPUT DROPiptables -P FORWARD DROP# Allow anything over loopback.iptables -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPTiptables -A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT# Drop any tcp packet that does not start a connection with a syn flag.iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP# Drop any invalid packet that could not be identified.iptables -A INPUT -m state --state INVALID -j DROP# Drop invalid packets.iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROPiptables -A INPUT -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN              -j DROPiptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST              -j DROPiptables -A INPUT -p tcp -m tcp --tcp-flags FIN,RST FIN,RST              -j DROPiptables -A INPUT -p tcp -m tcp --tcp-flags ACK,FIN FIN                  -j DROPiptables -A INPUT -p tcp -m tcp --tcp-flags ACK,URG URG                  -j DROP# Allow TCP/UDP connections out. Keep state so conns out are allowed back in.iptables -A INPUT  -p tcp -m state --state ESTABLISHED     -j ACCEPTiptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPTiptables -A INPUT  -p udp -m state --state ESTABLISHED     -j ACCEPTiptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT# Allow only ICMP echo requests (ping) in. Limit rate in. Uncomment if needed.iptables -A INPUT  -p icmp -m state --state NEW,ESTABLISHED --icmp-type echo-reply -j ACCEPTiptables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED --icmp-type echo-request -j ACCEPTiptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED --source $ssh -p tcp --dport 22 -j ACCEPTiptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -j DROPfor web in $http; do    iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED --source $web -p tcp -m multiport --dports 80,443 -j ACCEPT    iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp -m multiport --dports 80,443 -j DROPdone# or block ICMP allow only ping outiptables -A INPUT  -p icmp -m state --state NEW -j DROPiptables -A INPUT  -p icmp -m state --state ESTABLISHED -j ACCEPTiptables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPTSo I want just x.x.x.x be able to ssh to me. and also I want the follwing ips to see my 80,443 ports:x.x.x.xy.y.y.yhow can I change it?
Managing iptables for specific ips and ports
linux;ssh;security;iptables;http
I think you are putting your rules in the wrong order. In iptables, the -A appends to the chain, not inserts it before it. Normally, you have ... iptables -A INPUT  -p tcp -m state --state ESTABLISHED     -j ACCEPTand then# Drop any tcp packet that does not start a connection with a syn flag.iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROPInstead of changing the order, you could rewrite it with -I INPUT 1, so that each rule is inserted before the previous one, ie, at the top. But the tail ping/icmp rules will have to be moved in that case.Now, back to your question:iptables -N SSH_CHECKiptables -N HTTP_CHECKiptables -A INPUT -p tcp --dport 22 -j SSH_CHECKiptables -A INPUT -p tcp --dport 80 -j HTTP_CHECKiptables -A INPUT -p tcp --dport 443 -j HTTP_CHECKiptables -A SSH_CHECK -s x.x.x.x -j ACCEPT -m comment --comment allow joe to ssh from his IPiptables -A HTTP_CHECK -s y.y.y.y -j ACCEPT -m comment --comment allow mary to visit my HTTP/S serverYour default drop policy takes care of the non-conforming IPs.