Hello,

Is there such a way as to drop ALL traffic except those which are defined in a text file?

I want output the IP's which are located in a database to a text file on a different server, and whitelist those IP's on that server, but drop all others.

Firstly, is it possible? Secondly, what would be the best way about doing it from a different server?

Regards,
Karl

You could use a script to create iptables rules from the text file and use that to populate your iptables file then simply restart iptables so it reads in the modified file. You'd put in all your white list items towards the top of the file and your final rule would be the one that drops everything.

If this is a RHEL derived distro the iptables file is /etc/sysconfig/iptables.

yes, that's possible to achieve, but you wouldn't actually read them from a file as part of the rules. You'd need some script which will load the list and insert the rules into the rule base. You could take a few approaches, but I'd probably suggest that create a separate chain specifically for these IP addresses, and point your standard rulebase to that chain at the appropriate place. then write a separate script to take whatever form of output your database provides and drop each one into an iptables command in this new chain. so each time that file changes you flush out the chain and repopulate it really easily. That should be simple enough if you have no preferential way of doing it.

1 members found this post helpful.

Thanks for your advice guys, There's one problem, I wouldn't know where to begin to create such a script to do that.

At the end of the PDF posted at http://www.linuxquestions.org/questi...dresses-29893/ you'll find some eay ways to achieve what you want using the iptables "recent" module or using 'ipset'.