Ashley M. Kirchner wrote:
Is there a way to tell iptables specifically what networks to have a
port open for? Let's see if I can explain it better:
I run an internal NFS server that's available to all internal
machines (private IPs), and to 1 external server elsewhere (with a
public IP). I know I can use hosts.deny and hosts.allow to specifically
tell the daemons who to allow to connect, but I'm wondering if I can do
the same kind of fine-grained control with iptables? Basically, if I
run nmap against the NFS server's public IP, I don't want it to show
that NFS is running, however if I run nmap from the remote client, I
should be ale to see if. The same if I run nmap from (another) remote
location versus if I run it from within the network. The latter
scenario is the only time I want to see that the nfs port is open.
Is this possible?
Yes, you can specify the source address when writing a rule. In this
case, you would want to close the port by default, (drop
connections) and then have two rules, one for the local network, and
one for the remote machines's IP address. For added security, you
can have both incoming and outgoing rules.
Mikkel
--
Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!