ok i have been studying iptables, and i want to know if this iptable would close all ports apart from 80 and 21 thanx iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 21 -m state --state NEW,ESTABLISHED -j ACCEPT

You want a stateful filter for http(80) and ftp(21==control)? Why not something like: iptables -A INPUT -d $myhost -p tcp --syn --dport 80 state --state NEW -j ACCEPT iptables -A INPUT -d $myhost -p tcp --syn --dport 20:21 state --state NEW -j ACCEPT iptables -A INPUT -s 0/0 -d $myhost state \ --state ESTABLISHED -j ACCEPT iptables -A INPUT -s 0/0 -d $myhost state \ --state RELATED -j ACCEPT Read again.