Allowing traffic from an IP Address / Port in Linux iptables firewall

The above example lets any port 1024 and up from host 10.1.1.2 to pass thorugh to host 10.1.1.2 port 3306

My bad
that should read from host 10.1.1.1 to host 10.1.1.2

Hello Leon,

I have entered the following, but it does not seem to work:

iptables -A INPUT -p tcp -s 192.168.2.151 --sport 7778:7788 -d 228.5.6.7 --dport 14021:14030 -m state --state NEW,ESTABLISHED -j ACCEPT

I am not sure what I am doing wrong, but I want to allow traffic from 192.168.2.151:7778 through to 228.5.6.7:14021 to begin with and there will be other ports on these hosts later. But that is for starters. If I understood your instructions, this should work. Hmmm...

Please let me know what I am doing wrong.

Thanks,
Anthony

P.S. I do appreciate the input and I am sorry I couldn't get back sooner. I ended up having to rebuild a server from the O.S. up. :-(

It still didn't work. I don't know why. I am setting this part aside for now. I need to install a database on this server first, so I am backing everything out for now. Then I will try this again afterward. Thank you for you very much for the help!

Best Regards,
Tony

when you want bidirectional traffic, maybe you need two rules:

LOCALIP=1.1.1.1
REMOTEIP=2.2.2.2
LOCALPORT=3333
REMOTEPORT=4444

#allow from the other server to this one:
iptables -A INPUT -s $REMOTEIP -p tcp --sport $REMOTEPORT --dport $LOCALPORT -j ACCEPT

now go to the other server and allow traffic from this one:
LOCALIP=2.2.2.2
REMOTEIP=1.1.1.1
LOCALPORT=4444
REMOTEPORT=3333
iptables -A INPUT -s $REMOTEIP -p tcp --sport $REMOTEPORT --dport $LOCALPORT -j ACCEPT

I would try without requiring the source port. Matching the source port of the sending computer provides no extra protection anyway.

iptables -A INPUT -p tcp -s 192.168.2.151 -d 228.5.6.7 --dport 14021 -j ACCEPT

right. but you can define a port range that can be narrowed from oracle itself, like

--sport 1025:5025


good luck

i would recommend a firewall config tool.

I prefer  firehol see if you can install the package.

Thank you everyone for all of your input. The rule that finally worked for me was this:

iptables -I RH-Firewall-1-INPUT -s 192.168.2.105 -p tcp --dport 5901 -j ACCEPT

This exclusively restricts traffic to port 5901 (vncserver's default port) from IP 192.168.2.105. All others will never see it or get a response.

FYI, You can also mask the IP address like this:

iptables -I RH-Firewall-1-INPUT -s 192.168.2.0/8 -p tcp --dport 5901 -j ACCEPT
*OR*
iptables -I RH-Firewall-1-INPUT -s 192.168.0.0/16 -p tcp --dport 5901 -j ACCEPT
*OR*
iptables -I RH-Firewall-1-INPUT -s 192.0.0.0/24 -p tcp --dport 5901 -j ACCEPT

I think that leoneagan answered correctly to the question.