firewall to management ports (64295-64300) ? best approach

[dmille6]

i'd like to limit access to the management ports: 64295-64230 (I think that's correct), i'd like to make it where only a single IP address or IP range has access to those ports.

whats the best approach to do this ? is there already some sort of firewall running on a tpot? or do I just use UFW or BIND?
i just don't want to step on something that's already set up and working

[dmille6]

.. i did this.. seems to work.. let me know if this is a terrible idea.. but seems to work

sudo ufw allow from <your IP or IP RANGE> to any port 64290:64300 proto tcp
sudo ufw allow from <your IP or IP RANGE>  to any port 64290:64300 proto udp
sudo ufw allow 1:64289/tcp
sudo ufw allow 1:64289/udp

[dmille6]

all right this didnt work.. i can still access the maintenance ports and interface with UFW active.. any suggestions on why that is..

sudo ufw status
Status: active

To Action From

---

1:64289/tcp ALLOW Anywhere
1:64289/udp ALLOW Anywhere
1:64289/tcp (v6) ALLOW Anywhere (v6)
1:64289/udp (v6) ALLOW Anywhere (v6)
64290:64300/tcp ALLOW my IP address
64290:64300/udp ALLOW my IP address
64230:64290/tcp DENY Anywhere
64230:64290/udp DENY Anywhere
64230:64290/tcp (v6) DENY Anywhere (v6)
64230:64290/udp (v6) DENY Anywhere (v6)

[dmille6]

i ended up just putting a firewall in front of it.. and managing the ports in through the firewall.. not ideal.. but it works..

i dug a little deeper and it seems ip-tables is the firewall being used.. there is a script called rules.sh that is applying some rules.. and a file in /etc/ip-tables/rules.ipv4 that have some rules..

but I cant seem to get my additional rules to effect the honeypot.

I've tried:
sudo iptables -A INPUT -p tcp -s --dport 64290:64300 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 64290:64300 -j DROP

doesn't seem to work.