Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In this question I see a line like this that will allow me to say "allow these ip addresses to connect"

iptables -A INPUT -m iprange --src-range 10.50.10.20-80 -j ACCEPT

Now, I want to further secure this so that this rule only applies to specific ports. I've been using a command like this for my regular ports:

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

Can I combine these two to make a specific port allowed only for a range, like this

iptables -A INPUT -m iprange --src-range 10.50.10.20-80 --dport 12345 -j ACCEPT

Obviously I'm hesitant to just make iptables calls willy-nilly. :) Thanks!

share|improve this question

2 Answers 2

up vote 4 down vote accepted

The last line you have in there should work, you just need to make sure you have a -p protocol in there, as --dport doesn't work as a option on its own.

iptables -A INPUT -m iprange --src-range 10.50.10.20-80 -p tcp --dport 12345 -j ACCEPT
share|improve this answer

Alternatively, install ipset and you will be able to change the list of IP addresses without messing your iptables rules:

ipset -N AllowedSources ipmap --network 10.50.10.0/24
for i in $LIST_OF_ALLOWED_SOURCES; do ipset -A AllowedSources $i; done
iptables -A INPUT -m set --match-set AllowedSources src -p tcp --dport 12345 -j ACCEPT

Now, if you need to add another allowed source:

ipset -A AllowedSources a.b.c.d

Or, you need to 'drop' a host from the allowed sources:

ipset -D AllowedSources e.f.g.h

You can save your sets:

ipset --save > /etc/ipset.conf

Which you can restore during boot, before you implement your iptables (or else, iptables will complain!):

ipset --restore < /etc/ipset.conf

You can even create an IP set that will match against source IP and destination port, e.g.:

ipset -N AllowedAccess ipporthash --network 10.50.0.0/16
# These hosts may access port 12345
for i in $LIST_OF_ALLOWED_TO_12345; do ipset -A AllowedAccess $i,12345; done
# These hosts may access port 23456
for i in $LIST_OF_ALLOWED_TO_23456; do ipset -A AllowedAccess $i,23456; done
# These hosts may access port 34567
for i in $LIST_OF_ALLOWED_TO_34567; do ipset -A AllowedAccess $i,34567; done
# Now that the IP set has been created, we can use it in iptables
iptables -A INPUT -m set --match-set AllowedAccess src,dst -j ACCEPT
# Note that we use "src,dst", meaning that we want to match source IP, but
# destination port
# Also note, if you need to match against a single port, the ipmap method
# will be slightly faster.

More on ipset: http://ipset.netfilter.org/

If you are using Ubuntu, you can't install the ipset package from its repo. Use my tip: http://pepoluan.posterous.com/powertip-howto-install-ipset-on-ubuntu

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.