Implementing Network ACL for Memcached Using iptables

Introduction

Solving problems can take many paths; the author prefers using built-in system tools as “Swiss army knives” rather than IDE shortcuts.

Requirement

Memcached lacks built-in ACL, leading developers to accidentally connect development environments to production, causing data pollution. Various solutions exist, but the author advocates a simple network-level rule using iptables to block unwanted access.

Analysis

The simplest ACL is to reject traffic at the network layer; on Linux the iptables command is the natural choice.

iptables Settings

To allow only the production subnet (e.g., 10.6.0.0/16) to reach the Memcached port (11211) and reject everything else, run:

# iptables -A INPUT -p tcp -s 10.6.0.0/16 --dport 11211 -j ACCEPT
# iptables -A INPUT -p tcp --dport 11211 -j REJECT

Supplement

In a real environment you may edit the firewall file directly, for example:

*filter
……
-A INPUT -j dujiape_input
-A dujiape_input -i lo -j ACCEPT
-A dujiape_input -s 10.0.0.0/16 -m state --state NEW -j ACCEPT
…………
-A dujiape_input -p tcp --dport 11211 -m state --state NEW -j DROP
-A dujiape_input -j ACCEPT
COMMIT

Clear Rules

To flush all iptables rules: iptables -F If other rules exist, copy them before flushing and restore them afterward.

List Rules

To view current firewall rules:

iptalbes -L

Postscript

iptables will likely be used for a few more years, but with IPv6 adoption the future command may be ip (8), which supports both IPv4 and IPv6.