Need iptables help, 3 ip addresses one nic

[1clue]

Hi,

I have an existing server. It's a hosted machine with one internal-only management nic and another outward-facing nic. The outward facing nic has 3 IP addresses, and is what I'm concerned with here.

My setup:

1. 1 nic
   
2. 3 public IP addresses on the same subnet. For this discussion we'll say addresses 11,12,13.
   
3. Each IP address has a domain name, sharing a wildcard SSL certificate.
   
4. I have an apache2 front-end handling requests.
   
5. Each site has an app server which apache2 acts as a proxy for.
   
6. There is a hardware firewall which has been good up to now.
   
7. Firewall allows 443 and 80 to each host, but the hosting company says I can only restrict by NIC, not by IP address.
   

I want:

1. 2 sites to accept https and http (443 and 80) from anywhere.
   
2. 1 site to accept 443 only, and from exactly one remote IP address.
   

My iptables voodoo is very rusty, and frankly I've never tried something like 3 IPs on a single nic and different rules for each site.

Can someone help me out? I currently have the default setup, which is all-open.

Thanks.

[szatox]

You can filer by IP. Here's an example for accepting incoming traffic from a small pool of IPs to one of your addresses:

-A INPUT -s 10.0.0.0/24 -d 10.0.0.13 -p tcp -dport 443 -j ACCEPT # accept TCP traffic from 10.0.0.* incoming to port 443 at 10.0.0.13
-A INPUT -d 10.0.0.13 -j REJECT # drop everything else incoming to 10.0.0.13

[Hu]

szatox has a minor syntax error (-dport instead of --dport) and also suggests REJECT instead of DROP. I would use:

[1clue]

This is good stuff.

The real addresses are not contiguous but are inside a class c.

You gave me what I need to figure this out.

Thanks.