iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To whitelist one IPv4 address in iptables, insert an ACCEPT rule at the top of the INPUT chain: sudo iptables -I INPUT 1 -s 203.0.113.10/32 -j ACCEPT. The -s option matches the source address, /32 represents one IPv4 host, and inserting at position 1 puts the exception ahead of broad deny rules.
If the address only needs SSH access, use a narrower rule instead: sudo iptables -I INPUT 1 -p tcp -s 203.0.113.10/32 --dport 22 -j ACCEPT. Verify the live order and counters before closing your current session, and configure IPv6 separately with ip6tables when the VPS is reachable over IPv6.
What an iptables whitelist actually is
iptables has no separate “whitelist” object. A whitelist entry is an ordinary rule whose packet match describes a trusted source and whose target is ACCEPT. The kernel evaluates rules in an ordered chain and applies the target of the first matching rule. Targets commonly include ACCEPT, DROP, and REJECT.
For inbound traffic, the relevant chain is usually INPUT. A trusted-source ACCEPT rule must be reached before a broad DROP or REJECT; a later allow rule cannot rescue a packet that an earlier deny rule has already handled.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Ubuntu Server documentation describes the underlying netfilter subsystem as the part of the Linux kernel used to “manipulate or decide the fate of network traffic headed into or through your server.” iptables is one administration interface for those decisions.
Check the VPS before changing firewall rules
A firewall edit can terminate your only remote session. Perform these checks while your existing SSH connection is still open.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Confirm the public address that the VPS sees as the connection source. If you are behind a changing residential or mobile connection, the address may not remain stable.
- Keep a second administrative path available, such as the VPS provider’s console, in case an allow rule is mistyped.
- Find out which firewall manager owns the active rules. Ubuntu identifies UFW as its default firewall configuration tool. A provider panel or another distribution tool may also manage the rules.
- Record the current rules and their order before editing so you can compare the result and remove a mistaken entry.
Do not assume that a direct iptables command will become part of a manager’s configuration. Ownership and reboot persistence are separate questions.
Choose the address and the scope of the exception
The -s (or --source) option accepts a host address, a network address, or a CIDR mask. Choose the smallest range that satisfies the operational need.
| Need | Example source | What it matches | Risk and use |
|---|---|---|---|
| One IPv4 host | 203.0.113.10/32 |
Exactly one IPv4 address | Most restrictive choice for a fixed administrator or office address |
| Several IPv4 addresses in one subnet | 198.51.100.0/24 |
The addresses covered by that network mask | Useful for a managed office or VPN range; exposes more possible sources than a single host |
| One IPv6 host | 2001:db8::10/128 |
Exactly one IPv6 address | Must be configured with ip6tables, not iptables |
A /32 is one IPv4 host. For IPv6, the equivalent single-host mask is /128. Replace the documentation addresses above with the real address observed by your VPS; the example ranges are reserved for documentation and are not your personal public address.
Decide whether to allow all services or only one
A source-only rule allows matching traffic to every service governed by that chain. That may include SSH, web ports, databases, and administrative endpoints. If the requirement is only SSH, add the protocol and destination port to narrow the match. The narrower rule reduces the consequence of a compromised trusted host or an address reassignment.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsInsert an IPv4 whitelist rule
Allow all inbound traffic from one source
Use this form only when the trusted address genuinely needs access to all inbound services covered by INPUT:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
sudo iptables -I INPUT 1 -s 203.0.113.10/32 -j ACCEPT-I INPUT 1 inserts the rule in the INPUT chain at position 1. -s 203.0.113.10/32 matches packets from that address, and -j ACCEPT accepts matching packets. Putting it first makes the exception effective before a later broad deny.
Allow only SSH from one source
For an administrator who needs port 22 and nothing else, use:
sudo iptables -I INPUT 1 -p tcp -s 203.0.113.10/32 --dport 22 -j ACCEPTThis rule matches TCP packets from the selected source whose destination port is 22. It does not create permission for that source on other destination ports.
Allow one service on a trusted subnet
When several known addresses need SSH, substitute the network CIDR:
sudo iptables -I INPUT 1 -p tcp -s 198.51.100.0/24 --dport 22 -j ACCEPTReview the network range carefully. A mask that is wider than intended can authorize many addresses.
Use a different service port
Keep the same structure and replace 22 with the destination port required by the service:
sudo iptables -I INPUT 1 -p tcp -s 203.0.113.10/32 --dport 443 -j ACCEPTThe command expresses four criteria in one rule: TCP protocol, source address, destination port, and the ACCEPT target. Confirm the service’s actual listening port before applying it.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Confirm that the rule is live and ahead of the deny
Inspect both the human-readable listing and the rule specification:
sudo iptables -L INPUT -n -v --line-numbers
sudo iptables -S INPUTThe first command shows the INPUT chain with numeric addresses and ports, packet and byte counters, and line numbers. The second prints rules in a command-oriented form that makes the exact match criteria easier to compare.
- Locate the new
ACCEPTentry and verify the source address or CIDR is exactly what you intended. - Check that its line number is earlier than any broad
DROPorREJECTthat would otherwise match the connection. - From the trusted host, make the intended SSH or service connection.
- Run the listing again and check whether the allow rule’s packet and byte counters increased.
- Test from an address that should not be trusted, if you have a safe second network, to confirm that the rule is not broader than intended.
Do not close the original administrative session until the new connection succeeds and the rule order is confirmed. A successful existing SSH session alone does not prove that a new connection would pass; it may have been established before the rule change.
Configure IPv6 separately
iptables and ip6tables administer separate address families. An IPv4 allow rule does not authorize the corresponding IPv6 address.
Allow one IPv6 host to reach all inbound services
sudo ip6tables -I INPUT 1 -s 2001:db8::10/128 -j ACCEPTAs with IPv4, the rule is inserted at position 1, matches the source, and accepts it before a broad deny. Use /128 for one IPv6 host or the appropriate network prefix when multiple IPv6 addresses are required.
Restrict IPv6 SSH to port 22
sudo ip6tables -I INPUT 1 -p tcp -s 2001:db8::10/128 --dport 22 -j ACCEPTInspect IPv6 rules with the corresponding command:
sudo ip6tables -L INPUT -n -v --line-numbers
sudo ip6tables -S INPUTTest over an actual IPv6 path. A rule visible in ip6tables does not affect IPv4 traffic, and an IPv4 test does not validate IPv6 behavior.
Why an allow rule may appear not to work
The rule is below a DROP or REJECT
This is the most common ordering problem. If inspection shows the allow rule after a broad deny, insert it at the required position rather than appending it. The -I INPUT 1 form deliberately places it at the beginning; then verify that position against the complete chain.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
The source address is not the one you expected
Cloud gateways, VPNs, NAT devices, and changing client connections can make the VPS see a different source than the address shown on the client. Compare the rule’s source with the address recorded by the VPS for the failed connection. If the client’s address changes, a permanent single-host whitelist will eventually stop matching.
You edited the wrong address family
An IPv6 connection needs an ip6tables rule, while an IPv4 connection needs an iptables rule. Determine which address family the client is actually using and inspect that family’s INPUT chain.
The rule is broader or narrower than the requirement
A source-only rule may allow the address to every inbound service. Conversely, a rule containing --dport 22 will not permit a web or database connection. Compare the complete output from iptables -S INPUT with the service and port you are testing.
A firewall manager rewrites the rules
If UFW or another manager owns the firewall, a direct edit may conflict with its generated configuration or disappear when the manager reloads. Make changes through the owning manager when appropriate, or document that the direct rule is an intentional exception and verify it after reloads.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The command changed a live table but not the boot configuration
Seeing a rule immediately after running the command proves only that the current kernel rule set contains it. Reboot behavior depends on the VPS distribution, image, and firewall manager. Treat persistence as a separate configuration task and verify it after a controlled restart or manager reload.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Rule ownership and persistence after a reboot
There is no single save-and-restore command that is correct for every Linux VPS. Ubuntu commonly presents UFW as the default firewall configuration tool, while other images or hosting environments may use a different manager or provider-controlled firewall.
- Identify the active firewall manager and whether it generates the iptables rules.
- Determine where that manager stores its persistent policy and how it applies changes.
- Express the source, protocol, port, and ordering requirement in that manager’s configuration when it owns the rules.
- If direct iptables administration is intentional, follow the distribution-specific persistence method for that image rather than copying a command designed for another system.
- After a reload or reboot, run the appropriate
-Land-Sinspections again and perform a real connection test.
Do not report a temporary command as a permanent whitelist. Until the post-reboot rule set has been checked, persistence is unverified.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Safe operating patterns
Use the narrowest source range
Prefer /32 for one IPv4 address and /128 for one IPv6 address. Use a subnet only when multiple addresses genuinely need the exception, and document why that range is trusted.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Limit the service
Include -p tcp and --dport when the business need is SSH or one known service. A source-only rule is an all-services exception and should be treated as such.
Insert deliberately, then inspect
Appending a rule at the end can leave it unreachable. Use an explicit insertion position, inspect the complete chain, and confirm counters with a fresh connection.
Keep an out-of-band recovery path
Before changing a remote firewall, retain a provider console or another recovery route. This is especially important when modifying the only rule that permits administration.
Document address changes
When an office, VPN, or administrator’s public address changes, update the old rule rather than accumulating obsolete trusted ranges. A stale allow entry is an unnecessary access path.
Removing or correcting a mistaken rule
First capture the current numbered listing:
sudo iptables -L INPUT -n -v --line-numbersUse the displayed line number with the delete form when you have confirmed which entry is wrong:
sudo iptables -D INPUT <line-number>Replace <line-number> with the actual number; do not type the angle brackets. Because deleting a rule renumbers the entries below it, inspect the chain again before making another deletion. For IPv6, use the equivalent ip6tables commands.
If a manager owns the policy, remove the exception in that manager instead of deleting only the generated live rule. Otherwise the manager may recreate it on the next reload.
Decision checklist
- Address: Is the VPS seeing the exact source you intend to trust?
- Mask: Is one host sufficient, or is a documented subnet required?
- Service: Should the exception cover every inbound service or only a protocol and destination port?
- Family: Are you handling IPv4, IPv6, or both?
- Order: Is the allow rule before any matching broad deny?
- Ownership: Is the active policy managed directly, by UFW, or by another tool or provider?
- Verification: Did a new connection succeed and did the rule counters increase?
- Recovery: Do you still have console access if the rule is wrong?
- Persistence: Has the rule been verified after the manager reload or reboot procedure used by this VPS?
Practical command reference
| Purpose | IPv4 command | IPv6 command |
|---|---|---|
| Source-only allow for one host | sudo iptables -I INPUT 1 -s 203.0.113.10/32 -j ACCEPT |
sudo ip6tables -I INPUT 1 -s 2001:db8::10/128 -j ACCEPT |
| SSH-only allow for one host | sudo iptables -I INPUT 1 -p tcp -s 203.0.113.10/32 --dport 22 -j ACCEPT |
sudo ip6tables -I INPUT 1 -p tcp -s 2001:db8::10/128 --dport 22 -j ACCEPT |
| Inspect numbered rules and counters | sudo iptables -L INPUT -n -v --line-numbers |
sudo ip6tables -L INPUT -n -v --line-numbers |
| Print exact rule specifications | sudo iptables -S INPUT |
sudo ip6tables -S INPUT |
The commands in this table change or inspect the live firewall. They do not, by themselves, establish a universal reboot-persistence method.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
