Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to allow a certain IP addresses or a whole network (source) to reach my servers with ssh connection and to drop all other unauthorized source IP addresses.

share|improve this question
Have a look at Secure SSH Access you can also limit access directly within the ssh daemon – edgelab Jun 29 '15 at 12:35
iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED --source x.x.x.x -p tcp --dport 22 -j ACCEPT

access only from x.x.x.x

iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -j DROP

drop all other packets to port 22

share|improve this answer
Hopefully the default rule is REJECT in which case you wouldn't have to define the second rule. – dunxd Jul 29 '11 at 15:12
Note that this answer assumes that the OUPUT chain is unrestricted. First question is what security does filtering by state add to the first rule if you include all of the states except INVALID? Couldn't you remove RELATED from the rule? Second question is doesn't filtering by state on the second rule miss packets with state INVALID? Why not just drop the state filtering entirely on the second rule? – Jonathan Ben-Avraham Jan 20 '15 at 18:56
iptables -A INPUT -p tcp -s --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT

There are other ways to do it, but this is simplest when we know nothing about your other rules.

share|improve this answer

Sometimes command line IpTables syntax can be a bit much to learn/digest. If you're new(ish) to linux administration; you might consider installing something like webmin. You can use their gui to create your rules, and then go back and check the "/etc/sysconfig/iptables" file and see the actual syntax.

I would then recommend using Webmin & IpTables to lock down webin access to only those specific IP addresses you wish. You use the same syntax as some of the other posters have answered, just changing the PORT to whatever you setup Webmin to use. (Hopefully something OTHER than the standard port:10000).

share|improve this answer
I'd like to understand why someone would vote this down? Is this considered unhelpful? Poorly written? I'd genuinely appreciate the constructive criticism. – RealITGuy Jul 30 '11 at 13:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.