Ashley M. Kirchner wrote: > > Is there a way to tell iptables specifically what networks to have a > port open for? Let's see if I can explain it better: > > I run an internal NFS server that's available to all internal > machines (private IPs), and to 1 external server elsewhere (with a > public IP). I know I can use hosts.deny and hosts.allow to specifically > tell the daemons who to allow to connect, but I'm wondering if I can do > the same kind of fine-grained control with iptables? Basically, if I > run nmap against the NFS server's public IP, I don't want it to show > that NFS is running, however if I run nmap from the remote client, I > should be ale to see if. The same if I run nmap from (another) remote > location versus if I run it from within the network. The latter > scenario is the only time I want to see that the nfs port is open. > > Is this possible? > Yes, you can specify the source address when writing a rule. In this case, you would want to close the port by default, (drop connections) and then have two rules, one for the local network, and one for the remote machines's IP address. For added security, you can have both incoming and outgoing rules. Mikkel -- Do not meddle in the affairs of dragons, for thou art crunchy and taste good with Ketchup!
