Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently limit IP addresses that have access to my SSH service with a rule like this

 # accept already established 
 iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

 iptables -A INPUT -p tcp  --source w.x.y.z/32 --dport 22 -j ACCEPT
 iptables -A INPUT -p tcp  --source a.b.c.d/32 --dport 22 -j ACCEPT

 #drop everyting else
 iptables -A INPUT -j DROP 
 iptables -P FORWARD DROP

Where w.x.y.z and a.b.c.d are the allowed IPs.

I have this rule on multiple servers.

What would be the best way to be able to add and remove IPs to the allowed list and reload all servers rules so the changes are effective?

share|improve this question
up vote 2 down vote accepted

The best solution would be to use some sort of system management tool such as Puppet, Spacewalk, etc. Where you can push out configuration files to multiple computers at once. This will help you in the long run for other things as well. However, if you don't want to deal with all of the hassle of doing a central management type of setup, you could create ssh keys on all of the servers and then create scripts to modify and restart iptables.

  • Have SSH keys of all of your Linux server so you can do passwordless SSH logins
  • Create
    • ssh login@server1 'bash -s' <
    • ssh login@server2 'bash -s' <
    • ssh login@server3 'bash -s' <
  • Create a script that will modify your firewall rules and restart iptables
  • Run, which should login to all of your Linux machines and execute the script.

While I would highly recommend the central management solution, this way would be able to get the job done. As a disclaimer, I have never tried this but used the answer from this question to get the correct syntax -

share|improve this answer
Thanks that was very insight full, I will probably be starting with a simple script and post it here once it's been tested. – Patrick Forget Jun 12 '12 at 15:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.