2

I'm relatively new to using the command line so I'm understandably nervous about fiddling around with IP tables and accidentally doing something wrong which consequently opens up vulnerabilities in the firewall.

So, I thought I would ask here if my command usage was correct before actually trying to add this ip whitelisting rule via ssh.

iptables -I INPUT -p tcp -m multiport --dports http,https -s 204.93.240.0/24  204.93.177.0/24  199.27.128.0/21  173.245.48.0/20  103.22.200.0/22  141.101.64.0/18  108.162.192.0/18  190.93.240.0/20  188.114.96.0/20 -j ACCEPT

Is this usage correct? Not quite sure if it's possible to add all those IPs at once or if I have to add them manually one by one..

2 Answers 2

1

I can't comment on how wise it is to hardcode the netblocks of your CDN, because I'm presuming you've thought this through and have a way of ensuring you're updated if they deploy systems in a new datacenter. However, I will note that you'll need to comma-separate those CIDR-notated netblocks rather than space-separating them. :)

Also: your current invocation will work once the syntax is cleaned up, but if you don't specify a rule number after -I INPUT, it will get added at the end of your chain, where you probably already have a default-deny rule. In order words: this rule won't do anything where this command is going to put it.

Best way to handle this is to find and edit your rules file, then reload it.

1

Rather than trying to put them all in one line, you should have one line per IP address range. Unfortunately this seems to be what CloudFlare is recommending.

So the complete list would look like:

iptables -A INPUT -p tcp -m multiport --dports http,https -s 204.93.240.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 204.93.177.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 199.27.128.0/21 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 173.245.48.0/20 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 103.22.200.0/22 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 141.101.64.0/18 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 108.162.192.0/18 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 190.93.240.0/20 -j ACCEPT

ip6tables -A INPUT -p tcp -m multiport --dports http,https -s 2400:cb00::/32 -j ACCEPT
ip6tables -A INPUT -p tcp -m multiport --dports http,https -s 2606:4700::/32 -j ACCEPT

Fortunately they have the lists available as plain text files that you can fetch from time to time and incorporate into a firewall-building script.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .