Member Avatar for CoolAtt

Hi All,

I need help with iptables to allow a specific IP to access a destination (FaceBook)

The following rule blocks facebook access to everyone in the company(this rule works successfully):

 iptables -A FORWARD -p all -d $ip -j REJECT

(The ip address is read from a text file.)

Now I want to allow one person access to FB.

I tried the following but its not working:

iptables -A FORWARD -p all -s 10.0.0.x  -d $ip -j ACCEPT

Please help & advise me.

  • 2 Contributors
  • 2 Replies
  • 390 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by CoolAtt

Dani AI

Generated

Short note: the problem was rule order — iptables walks rules top-to-bottom and stops at the first match. 's advice to insert the allow before the existing REJECT is correct, and 's switch from appending to inserting fixed the issue.

A few practical tips and clarifications:

  • Appending with -A puts the rule at the end of the chain; inserting with -I puts it at the head (or at a specific position when a number is given). Confirm the chain order and rule numbers before and after changes with:
    iptables -L FORWARD -n --line-numbers
  • Prefer limiting the allow to only the required protocols/ports instead of all. For example, allow just HTTP/HTTPS from one source to a specific destination (placeholders shown):
    iptables -I FORWARD 1 -p tcp -s 10.0.0.5 -d <FB_IP> -m multiport --dports 80,443 -j ACCEPT
  • If Facebook spans many IP blocks, use ipset to store those networks and match the set in a single iptables rule; this is much easier to maintain than hundreds of individual rules:
    ipset create fbnet hash:net
ipset add fbnet <FB_CIDR>
iptables -I FORWARD 1 -m set --match-set fbnet dst -s 10.0.0.5 -j ACCEPT
  • Persistence and verification: save rules with the distro-appropriate method (or iptables-save) and verify matches with iptables -vnL --line-numbers FORWARD or tcpdump on the interface. Note that if the traffic originates on the firewall itself, the OUTPUT chain must be used instead of FORWARD. Finally, IP-based allow/deny for large services is brittle; a proxy or DNS-based control is usually more reliable for domain-level policies.

Recommended Answers

All 2 Replies

Member Avatar for cereal

Add 1 after FORWARD, that will put the rule in the first place of the chain, otherwise the firewall applies the first matching rule.

The number given after the chain name indicates the position before an existing Rule. So, for example, if you want to insert a Rule before the third rule you specify the number 3. Afterward, the existing Rule will then be in the fourth position in the chain.

More information: https://fedoraproject.org/wiki/How_to_edit_iptables_rules

Member Avatar for CoolAtt

Thanks a lot cereal

The -A must be replaced with -I else i get syntax error.

the correct working syntax is:

iptables -I FORWARD 1 -p all -s 10.0.0.x  -d $ip -j ACCEPT`
Edited by CoolAtt
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.