5

I am trying to allow SSH access to a certain range of IPs (from 192.168.1.1 to 192.168.1.24) and block all the rest, but since I am new to iptables I can't seem to figure it out. I have :

iptables -A INPUT -s 192.168.1.0/24 -p udp --dport ssh -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT
iptables -A INPUT -p udp --dport ssh -j REJECT

Tut this does not work, with a VM set with 192.168.1.89 I can still access through SSH. Can someone help?

3 Answers 3

8

192.168.1.0/24 is not from 1 to 24 but using 24 bits (= the 3 1st blocks) so it will accept anything starting with 192.168.1. The right one is /27 but it will allow up to 192.168.1.31.

The next smaller range will be /28 that will allow up to 192.168.1.15.

4
  • so how can i do this the proper way?
    – psychok7
    Oct 19, 2012 at 3:06
  • 1
    I was calculating that. Edited answer :)
    – laurent
    Oct 19, 2012 at 3:07
  • If you use 28, you can allow from ....1 to ...15
    – laurent
    Oct 19, 2012 at 3:10
  • found this calculator subnet-calculator.com
    – psychok7
    Oct 19, 2012 at 3:30
7

/24 is the CIDR length, not a range.

To use a range, do this:

iptables -A INPUT -m iprange --src-range 192.168.1.1-192.168.1.24 -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT
0

The First DROP all INPUT Rullse ( For more security) The Second : iptables -A INPUT -p tcp -i eth0 --dport 22 -m iprange --src-range 192.168.1.1-192.168.1.24 -j ACCEPT Have good time

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .