1. Host Service Ports 1 2 iptables -I INPUT -p tcp --dport 80 -j DROP iptables -I INPUT -p tcp -s 1.2.3.4 --dport 80 -j ACCEPT This allows only 1.2.3.4 to access port 80 on the local host. 2. Docker Service Ports For services started like docker run -d -p 80:80 shaowenchen/demo:whoami, the method above does not work; the rule has to be added to the DOCKER-USER chain.