The fundamental challenge here is configuring iptables to permit bidirectional communication with a specific IP address while maintaining security. The original attempt used:

/sbin/iptables -A INPUT -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT

From the provided iptables status, we can identify several potential issues:

• The OUTPUT chain has a default DROP policy
• Rule #10 in OUTPUT only allows traffic to the specific IP
• No UDP rules exist for the IP
• The rules are appended (-A) rather than inserted at optimal positions

Here's the comprehensive approach to enable full communication:

# Allow all incoming traffic from specific IP
iptables -I INPUT 1 -s XXX.XXX.XXX.XXX -j ACCEPT

# Allow all outgoing traffic to specific IP
iptables -I OUTPUT 1 -d XXX.XXX.XXX.XXX -j ACCEPT

# For stateful connections (recommended)
iptables -I INPUT 2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I OUTPUT 2 -m state --state ESTABLISHED,RELATED -j ACCEPT

After applying these rules, verify with:

iptables -L -v -n | grep XXX.XXX.XXX.XXX

Test connectivity using:

ping XXX.XXX.XXX.XXX
nc -zv XXX.XXX.XXX.XXX 22

For more granular control:

# Allow specific ports only
iptables -A INPUT -p tcp -s XXX.XXX.XXX.XXX --dport 22,80,443 -j ACCEPT

# Rate limiting for security
iptables -A INPUT -s XXX.XXX.XXX.XXX -m limit --limit 5/min -j LOG --log-prefix "IPTABLES: "
iptables -A INPUT -s XXX.XXX.XXX.XXX -m connlimit --connlimit-above 10 -j DROP

If problems persist:

1. Check for conflicting rules: iptables -L -n --line-numbers
2. Verify rule order with: iptables-save
3. Test with temporary accept-all policies:

   iptables -P INPUT ACCEPT
   iptables -P OUTPUT ACCEPT

When working with Linux firewalls, a common requirement is allowing unrestricted communication with a specific IP address while maintaining other security restrictions. The challenge comes when default policies are set to DROP and rule ordering affects packet processing.

The existing configuration shows several key characteristics:

Chain INPUT (policy DROP)
Chain OUTPUT (policy DROP)
Chain FORWARD (policy DROP)

The rules attempt to allow access to XXX.XXX.XXX.XXX appear as:

19   ACCEPT     tcp  --  XXX.XXX.XXX.XXX      0.0.0.0/0
10   ACCEPT     tcp  --  0.0.0.0/0            XXX.XXX.XXX.XXX

For complete bidirectional access, we need to modify both INPUT and OUTPUT chains with proper protocol handling:

Recommended Rule Set

# Allow all protocols from specific IP (inbound)
iptables -I INPUT 1 -s XXX.XXX.XXX.XXX -j ACCEPT

# Allow all protocols to specific IP (outbound)
iptables -I OUTPUT 1 -d XXX.XXX.XXX.XXX -j ACCEPT

# Allow established/related connections
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

If problems persist after implementing these rules:

1. Verify rule order with iptables -L -v -n
2. Check if NAT is interfering iptables -t nat -L
3. Test raw connectivity with tcpdump -i eth0 host XXX.XXX.XXX.XXX

For more granular control while maintaining access:

# Allow specific ports for the IP
iptables -A INPUT -s XXX.XXX.XXX.XXX -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d XXX.XXX.XXX.XXX -p tcp --sport 22 -j ACCEPT

# Allow ICMP (ping)
iptables -A INPUT -s XXX.XXX.XXX.XXX -p icmp -j ACCEPT
iptables -A OUTPUT -d XXX.XXX.XXX.XXX -p icmp -j ACCEPT

After testing, save the rules permanently:

service iptables save   # On CentOS/RHEL
iptables-save > /etc/iptables.rules   # On Debian/Ubuntu