Take the 2-minute tour ×

How do I use iptables to reject all traffic to localhost port 80 but allow the one that comes from local machine?

Here is my current solution that doesn't seems to block the traffic. the ip, the the ip of the local machine. If I do not put the 2nd line, all the traffic is block, and with it enabled, all the traffic is accepted ?!

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT

iptables -A INPUT -p tcp --dport 80 -j LOG --log-prefix "TCP LOGDROP: "

Just to be sure:

  • is the ip of the web server, where I want to be able to access
  • I do want to reject any connections on port 80, others then the ones originated from localhost.
share|improve this question
how exactly are you trying to connect? what hostname/ip do you try to connect to? –  stew Jul 13 '12 at 15:12
I am trying to connect to using one of the DNS entries mapping to, nginx is listening to ports 80 and 443. 443 is configured to fallback to 80 and keep the hostname requested. I just want an iptables rule that I can run to prevent direct connection to port 80 to this machine. –  sorin Jul 13 '12 at 15:14
You do realise that localhost == don't you ? –  Iain Jul 13 '12 at 15:18
add comment

2 Answers

iptables -I INPUT ! -i lo -p tcp --dport 80 -j DROP

When you the traffic goes from your machine to your machine, always has the input interface "lo". It doesn't matter the src or dst IP address.

share|improve this answer
I usually see iptables rules -A (appending) to a chain, is there a particular reason you use insert (-I)? –  Luc Aug 12 '13 at 14:02
Depends on your rule set. That command inserts the rule in the first place, but if you have the rules in a file, you should know where is the best place for it. And you must use -A there. –  diegows Aug 14 '13 at 14:33
add comment

Could you please provide the entire contents of /etc/sysconfig/iptables if possible? (i'll update my answer if applicable once the information is made available)

As I have to work on the assumption that there is no default DROP rule in place, as such you need:



share|improve this answer
The file does not exist at all and as you've seen, I am resetting iptables, just to be sure. From what I see the 4th line, added by you is doing almost the same as the 3rd one, the only difference being that mine is logging the dropped packages, which is good for debugging. –  sorin Jul 13 '12 at 17:15
add comment

Your Answer


