Recommended Free Tools
To whitelist one IPv4 address in iptables, insert an ACCEPT rule for that source before any broad DROP or REJECT rule:
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
sudo iptables -I INPUT 1 -s 203.0.113.10/32 -j ACCEPTFor SSH only, narrow the exception to TCP port 22:
sudo iptables -I INPUT 1 -p tcp -s 203.0.113.10/32 --dport 22 -j ACCEPTReplace the example address with the public address that should be trusted. A whitelist is not a separate iptables object; it is an ordered rule whose matching packets receive the ACCEPT target. The important details are the address mask, the service scope, and the rule’s position in the chain.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What an iptables whitelist actually does
iptables evaluates packets against rules in an ordered chain. Each rule matches characteristics such as source address, protocol, and destination port, then applies a target such as ACCEPT, DROP, or REJECT. A source allow rule therefore means: when a packet matches these criteria, accept it before a later deny rule can handle it.
The usual inbound chain is INPUT. A source-only rule applies to every inbound service covered by that chain, while a rule that also specifies protocol and destination port grants access only to the required service. Rule order is decisive: once a packet reaches a matching terminating target, a later rule cannot rescue it.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the address mask correctly
| Need | Example source | Meaning |
|---|---|---|
| One IPv4 host | 203.0.113.10/32 |
Exactly one IPv4 address. The /32 mask represents one host. |
| Several IPv4 addresses in one network | 198.51.100.0/24 |
Every address in that network range can match. |
| One IPv6 host | 2001:db8::10/128 |
Exactly one IPv6 address. IPv6 uses a separate administration command. |
The -s or --source option accepts a host, network address, or CIDR mask. Use the narrowest range that meets the operational need. A changing home connection may not remain on the same public address; in that case, a fixed network address, VPN range, or another controlled access method may be more reliable than continually widening the rule.
Check ownership and prevent a lockout first
Before editing a live VPS firewall, keep an existing administrative session open. Test a new session only after the rule is visible and counters change as expected. If the new rule is wrong, the original session may be your only way to remove it.
Also identify which component owns the active firewall policy. Ubuntu documentation describes UFW as the default firewall configuration tool, while iptables is the underlying packet-filter administration interface. A distribution, hosting provider, cloud image, or firewall manager may regenerate rules. Direct commands can appear to work temporarily and then be overwritten if another manager controls the policy.
- Record whether the server uses direct iptables rules, UFW, or a provider-managed firewall.
- Confirm whether the connection reaches the VPS over IPv4, IPv6, or either address family.
- Write down the current rule set before making changes so you can compare and recover.
- Use a public source address that the VPS will actually see. A private address from your laptop’s local network is not the source address on an Internet connection.
The Linux kernel includes the netfilter subsystem, which decides the fate of traffic headed into or through the server. iptables is one interface for configuring those decisions; it is not an independent network path or authentication system.
Step-by-step: allow one IPv4 address to a VPS
1. Identify the trusted source
Determine the public IPv4 address from which the administrator or application will connect. Represent a single host with a /32 suffix, such as 203.0.113.10/32. If an entire managed network must connect, use its CIDR range instead, for example 198.51.100.0/24. Do not use a broad range merely because it is convenient; every address in the range becomes eligible for the rule.
2. Insert a source-only allow rule when all services should be reachable
sudo iptables -I INPUT 1 -s 203.0.113.10/32 -j ACCEPTHere, -I INPUT 1 inserts the rule at position 1 in the INPUT chain. -s matches the packet’s source address, and -j ACCEPT accepts packets that match. Inserting at the first position is intentional: it places the exception ahead of a broad deny rule elsewhere in the chain.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
This form is broad. It permits the trusted source to reach any inbound service that is otherwise governed by this chain. Use it only when that breadth is required, such as a tightly controlled administration network that needs several services.
3. Prefer a service-specific rule for SSH
sudo iptables -I INPUT 1 -p tcp -s 203.0.113.10/32 --dport 22 -j ACCEPTThis rule matches TCP packets from the trusted IPv4 host whose destination port is 22, the conventional SSH port, and accepts them. Adding protocol and destination-port criteria limits the exception to SSH instead of all inbound traffic. If SSH is configured on a different port, use that port in --dport.
The same design applies to another service: retain the source match, select the correct protocol, and specify that service’s destination port. Do not add a port restriction when the requirement genuinely covers every service; do not omit it when only one service is needed.
4. Inspect the live chain
sudo iptables -L INPUT -n -v --line-numbers
sudo iptables -S INPUTThe first command displays the INPUT chain without reverse-DNS lookups, includes packet and byte counters, and numbers each rule. The second prints rules in a command-style form that makes their matches and targets easier to compare. Confirm that the allow rule appears before any broad DROP or REJECT rule. If a preceding rule matches the same traffic, the new rule may never be reached.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →5. Test from the trusted address
Open a new connection from the whitelisted source while retaining the original administrative session. For SSH, test the actual public address and configured port. Then run the listing command again and check whether the packet and byte counters on the allow rule increased. A successful connection proves that the path, service, and rule matched; an unchanged counter indicates that the traffic did not reach that rule or did not match its criteria.
Choose the narrowest useful rule
| Implementation | Example | Exposure | Use when |
|---|---|---|---|
| One IPv4 host, all inbound services | -s 203.0.113.10/32 -j ACCEPT |
Broadest | The source must reach multiple services and is trusted for all of them. |
| One IPv4 host, SSH only | -p tcp -s 203.0.113.10/32 --dport 22 -j ACCEPT |
Limited to TCP port 22 | The requirement is administrative SSH access only. |
| IPv4 subnet, one service | -p tcp -s 198.51.100.0/24 --dport 22 -j ACCEPT |
Every host in the subnet can attempt SSH | A managed network, rather than one fixed host, needs access. |
| One IPv6 host | ip6tables -I INPUT 1 -s 2001:db8::10/128 -j ACCEPT |
Separate IPv6 policy | The client connects over IPv6. |
Scope has two independent dimensions: how many source addresses are trusted and how many services they can reach. Keep both dimensions as small as the business requirement allows.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Configure the IPv6 equivalent separately
iptables and ip6tables are separate administration tools for IPv4 and IPv6. An IPv4 allow rule does not automatically authorize the same client over IPv6. If the VPS has IPv6 enabled and the client can prefer or fall back to it, create a corresponding IPv6 rule:
sudo ip6tables -I INPUT 1 -s 2001:db8::10/128 -j ACCEPTUse /128 for one IPv6 address. For SSH only, add the same TCP and destination-port matches used in the IPv4 rule:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchsudo ip6tables -I INPUT 1 -p tcp -s 2001:db8::10/128 --dport 22 -j ACCEPTInspect the IPv6 chain independently:
sudo ip6tables -L INPUT -n -v --line-numbers
sudo ip6tables -S INPUTTest the address family you intend to support. A successful IPv4 connection does not demonstrate that IPv6 is permitted, and an IPv6 rule cannot match an IPv4 packet.
Why an allow rule may not work
A deny rule appears first
Run the numbered listing and compare the allow rule with every earlier DROP or REJECT. If a broad deny precedes the exception, insert the allow rule at an earlier position or adjust the policy through the manager that owns the chain. Appending an allow rule at the bottom is ineffective when traffic has already matched a preceding deny.
The rule matches the wrong address
The source seen by the VPS may differ from the address shown on a local device. NAT, a corporate gateway, a VPN, or a proxy can make the server see the gateway’s public address rather than the workstation’s private address. Check the source address recorded by the server or provider and use that address, with the correct CIDR mask.
The connection uses IPv6
If the client resolves the VPS to an IPv6 address or prefers IPv6, an IPv4 rule cannot help. Inspect and test the ip6tables chain, then add a separate IPv6 rule if that access path is intended.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
The rule is too narrow
A rule restricted to -p tcp --dport 22 will not permit another protocol or port. Verify the service’s actual transport protocol and listening port. Conversely, do not remove those matches simply to make testing pass unless broader exposure is acceptable.
A firewall manager rewrites the chain
Rules entered directly may disappear when UFW, a provider firewall, or another configuration service reloads its policy. Identify the owner before making a permanent change and express the allowlist through that owner’s supported configuration where possible. Mixing independent sources of truth makes the effective order difficult to predict.
The packet never reaches the VPS
iptables can only evaluate traffic that arrives at the server’s network path. A provider-level firewall, security group, routing problem, or incorrect destination address can block a connection before the local INPUT chain sees it. An unchanged iptables counter is a useful clue that the packet did not match locally, but it does not identify which upstream component blocked it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Inspect, remove, and revise a rule safely
Always inspect numbered rules before deleting one:
sudo iptables -L INPUT -n -v --line-numbersIf the allow rule is, for example, number 3, remove that exact rule by number:
sudo iptables -D INPUT 3Because rule numbers can change after an insertion or deletion, obtain a fresh listing before a second numbered deletion. You can also delete by repeating the complete rule specification, which avoids relying on a possibly changed number:
sudo iptables -D INPUT -p tcp -s 203.0.113.10/32 --dport 22 -j ACCEPTAfter removal or modification, list the chain again and test from both an authorized and an unauthorized source when you can do so safely. A rule’s counter confirms matches, not that the application itself is healthy; a service can still reject a connection after iptables accepts it.
Persistence after a reboot is manager-specific
Creating a rule in the live kernel does not establish one universal reboot-persistence mechanism. The correct save and restore procedure depends on the Linux distribution, VPS image, installed packages, and whether UFW or another manager owns the policy. Do not assume that a command copied from another distribution will restore these rules correctly.
- Determine which service loads firewall rules during boot.
- Make the allowlist change in that service’s configuration when it is the policy owner.
- Verify the rule after a controlled reload or reboot, retaining console or out-of-band access in case the configuration fails.
- Check both IPv4 and IPv6 persistence if both address families are enabled.
If direct iptables commands are required, document the exact mechanism used by the VPS image and confirm after reboot that the rule is present, correctly ordered, and accumulating counters. Persistence is an operational property of the firewall manager, not of the ACCEPT target itself.
Practical designs for common VPS requirements
Only one administrator’s IPv4 address may use SSH
- Keep an existing session open.
- Insert
sudo iptables -I INPUT 1 -p tcp -s 203.0.113.10/32 --dport 22 -j ACCEPT. - List the chain with counters and line numbers.
- Open a second SSH session from that public address.
- Confirm the counter increases, then configure persistence through the active firewall manager.
This design leaves other inbound services governed by their existing rules rather than granting the administrator’s address unrestricted access.
A company subnet needs SSH access
Use the company’s actual CIDR, such as 198.51.100.0/24, in the same service-specific rule. Every host in that subnet can attempt SSH, so confirm that the range is controlled and does not include guest or untrusted networks. If only selected hosts need access, separate /32 rules are narrower.
An automation service needs one TCP port
Match the service’s source range, TCP protocol, and destination port instead of using a source-only rule. This limits the exception to the application path and leaves unrelated inbound services outside the whitelist.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Security and operational checklist
- Use
/32for one IPv4 host and/128for one IPv6 host. - Use a subnet CIDR only when every address in that range is trusted.
- Insert the exception before broad deny rules.
- Restrict by protocol and destination port whenever the requirement is service-specific.
- Handle IPv4 with iptables and IPv6 with ip6tables.
- Inspect rules with numeric addresses, counters, and line numbers.
- Test from the real public source address, not a private local address.
- Keep a working administrative session until the replacement path is verified.
- Identify UFW, provider controls, or another manager before mixing direct commands with managed rules.
- Plan and verify reboot persistence for the particular VPS image.
Bottom line
Whitelisting in iptables means inserting an ordered ACCEPT rule that matches the trusted source before a deny rule. Start with a single-host CIDR, narrow the rule to TCP port 22 when the goal is SSH, inspect counters and order, and create a separate ip6tables rule for IPv6. The safest implementation is the one with the smallest trusted source range, the fewest exposed services, and a clearly identified firewall manager responsible for keeping the policy in place.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
