Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here is my iptables, how can I make it so that I can allow a range of ip's on ETH1 (10.51.x.x)

# Generated by iptables-save v1.4.4 on Thu Jul  8 13:00:14 2010
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh 
-A INPUT -i lo -j ACCEPT 
-A INPUT -d ! -i lo -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 
-A INPUT -j REJECT --reject-with icmp-port-unreachable 
-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A fail2ban-ssh -j RETURN 
share|improve this question

4 Answers 4

up vote 13 down vote accepted

If you only want to allow a certain range of IP addresses inside of (such as from through you can use the following command:

iptables -A INPUT -i eth1 -m iprange --src-range -j ACCEPT

If you want to allow the entire range you can use this instead:

iptables -A INPUT -i eth1 -s -j ACCEPT

See iptables man page and this question here on ServerFault: Whitelist allowed IPs (in/out) using iptables

share|improve this answer
Where do I put this line? – Mike Curry Jul 17 '10 at 19:39
Those are the commands that you would run from the command line: [root@host ~]# iptables -A INPUT -i eth1 -s -j ACCEPT – runlevelsix Jul 17 '10 at 21:39
Use "", "-80" might not do what you want. – basic6 May 24 at 11:16

Well you did saw what you want to allow those IPs for but 10.51.x.x in CIDR translates to So it will be something like the line for the loopback interface that has

share|improve this answer
iptables -A INPUT -i eth1 -m iprange --src-range -j ACCEPT

May give the following error:

iptables: Applying firewall rules: xt_iprange: range is reversed and will never match

To correct this just put the full ip instead like this:

iptables -A INPUT -i eth1 -m iprange --src-range -j ACCEPT


share|improve this answer

For a specific port say 22 :

-A INPUT -p tcp  -m iprange --src-range  --dport 22  -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.