Debian 9 - Allow specific IP to connect to MongoDB

Question

Debian 9 - Allow specific IP to connect to MongoDB

Navigation

#1 by (1 votes)

0

I have tried to solve the problem with IPTables, but the truth is not very clear to me.

.
iptables -A INPUT -s 192.168.1.120 -p tcp --destination-port 27017 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -d 192.168.1.120 -p tcp --source-port 27017 -m state --state ESTABLISHED -j ACCEPT
.

I do not understand.

I execute the code and it works, but from there. I do not know what he did or what changes he made.

And as such, my purpose is to register the IPs that can access Mongo or their port , and not allow access to Mongo strong> with other IP.

mongodb debian debian-9

asked by Máxima Alekz 05.10.2017 в 17:35

source

1 answer

include javascript / jquery functions in backbone template Enter several values in the same input? Example: multiple mail recipients

score 1 · Accepted Answer

Here is an answer that I found

iptables -P INPUT ACCEPT #Aceptar todas las conexiones ENTRANTES de cualquier IP
iptables -P OUTPUT ACCEPT #Aceptar todas las conexiones SALIENTES de cualquier IP
iptables -A INPUT --source 192.168.2.153 --destination 192.168.2.180 --protocol tcp --dport 27016 --jump ACCEPT #ACEPTAR UNICAMENTE LA CONEXION DE 192.168.2.153 A LA IP 192.168.2.180(MAQUINA HOST), Y UNICAMENTE AL PUERTO 27016 (MONGODB)
iptables -A INPUT --source 192.168.2.153 --destination 192.168.2.180 --protocol tcp --dport 22 --jump ACCEPT #ACEPTAR UNICAMENTE LA CONEXION DE 192.168.2.153 A LA IP 192.168.2.180(MAQUINA HOST), Y UNICAMENTE AL PUERTO 22 (CONEXIONES SSH)
iptables -A OUTPUT --source 192.168.2.180 --jump ACCEPT #Aceptar todas las conexiones salientes únicamente de la IP 192.168.2.180(MAQUINA HOST)
iptables -A INPUT --destination 192.168.2.180 --jump DROP #NEGAR | PROHIBIR acceso de entrada a cualquier IP no listada, las conexiones entrantes a 192.168.2.180(MAQUINA HOST)
.

With the above code the incoming connection of the ip 192.168.2.153 to the ip of the server 192.168.2.180 will be allowed only if the ports are 22 ( SSH connection) or ( in this case ) 27016 ; connections to other ports will be rejected.

Any outgoing connection from the ip of server 192.168.2.180 will be allowed, but any connection to the ip of server 192.168.2.180 that is NOT listed will be rejected.

Plus - Save the configuration, run it and make it persistent

To save this iptables configuration, make sure you are an Administrator or SuperUser:

su

Then create a .sh file with nano. Keep it in a folder and keep in mind where you kept it.

cd /etc/ #Ir a la carpeta etc, eso es decisión de ustedes
mkdir prueba-iptables #Crear un carpeta llamada prueba-iptables
cd prueba-iptables #Abrir la carpeta prueba-iptables (Recordar que estamos actualmente en /etc/)
nano reglas.sh #Abrir el editor nano, para crear el archivo reglas.sh
.

We'll see something like this

Write the aforementioned iptables configuration:

You should see more or less like this

Next, press CTRL + or , and ENTER

With this they will have "reglas.sh" saved in / etc / prueba-iptables /

Press CTRL X to exit the nano editor

Write to the terminal (console):

/etc/prueba-iptables/reglas.sh  #Esto ejecuta el codigo en reglas.sh
.

If all is well, nothing should come out.

Then, write:

iptables-save > /etc/iptables/rules.v4 #Esto guarda la configuración actual (temporal) de iptables en rules.v4 para después hacerlas permanentes
.

Then, write:

dpkg-reconfigure iptables-persistent #Saldrá un cuadro grande en pantalla completa, aceptar IPv4, IPv6 según necesites, si eres nuevo. Sólo acepta (yes).
reboot #Reiniciar la máquina fisica del servidor !!!Cuidado con esto, preguntar primero si está permitido reiniciar la máquina en su empresa o negocio!!!
.

And that's it, they'll have the iptables configuration saved and persistent.

To verify that the rules are running, enter the console:

iptables -L

Keep in mind that it will take time to load the rules.

To reset the rules to their original state (Allow all ips):

iptables -F #Limpiar las reglas de iptables
iptables-save > /etc/iptables/rules.v4 #Guardar la nueva configuracion de iptables
dpkg-reconfigure iptables-persistent #Reconfigurar
reboot #Reinciar la maquina host.
.

And ready:))

I hope you find it useful