How can i reject connection from LAN and WAN to some ports?

Question

Scanning with nmap, I discovered that there are 3 open ports on my server. I want to deny any access to these ports from any machine, regardless of whether it is on the same LAN or via WAN. How do I write an iptables rule for this?

Answer 1

Are you trying to block all open ports on a specific interface? If so, you can use the following command

iptables -A INPUT -i <interfaceName> -j DROP

for example:

iptables -A INPUT -i eth0 -j DROP

where eth0 is usually for LAN interface

and

iptables -A INPUT -i eth1 -j DROP

usually for WAN

Answer 2

If you want to deny access to all the machines ("any machine from LAN and WAN") it is better to either stop those services or bind them to the localhost. This way there will be no chance of messing up iptable rules.

Still, you can use IPTABLES to block access to specific ports as well.

iptables -A INPUT -p tcp --destination-port <port of the service you want to block> -j DROP

Repeat the above rule for all the ports you want to block access to.

Answer 3

To close an individual port, you can do the following.

iptables -A INPUT ! -i lo -p tcp --dport 80 -j REJECT

Adjust tcp to be udp if that's the case, change 80 to the appropriate port. That will reject anything that didn't come from the local loopback interface.

See also Reject IP packets with an ICMP error, or just drop them?

Note that this solves the individual problem, but in a general sense you should explicitly allow which ports you wish to have open and then deny the rest. Particularly since you probably still want to access these ports from your the local machine, that adds a lot more convenience in rule writing as well.