Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm relatively new to using the command line so I'm understandably nervous about fiddling around with IP tables and accidentally doing something wrong which consequently opens up vulnerabilities in the firewall.

So, I thought I would ask here if my command usage was correct before actually trying to add this ip whitelisting rule via ssh.

iptables -I INPUT -p tcp -m multiport --dports http,https -s 204.93.240.0/24  204.93.177.0/24  199.27.128.0/21  173.245.48.0/20  103.22.200.0/22  141.101.64.0/18  108.162.192.0/18  190.93.240.0/20  188.114.96.0/20 -j ACCEPT

Is this usage correct? Not quite sure if it's possible to add all those IPs at once or if I have to add them manually one by one..

share|improve this question
add comment

2 Answers

Rather than trying to put them all in one line, you should have one line per IP address range. Unfortunately this seems to be what CloudFlare is recommending.

So the complete list would look like:

iptables -A INPUT -p tcp -m multiport --dports http,https -s 204.93.240.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 204.93.177.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 199.27.128.0/21 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 173.245.48.0/20 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 103.22.200.0/22 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 141.101.64.0/18 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 108.162.192.0/18 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports http,https -s 190.93.240.0/20 -j ACCEPT

ip6tables -A INPUT -p tcp -m multiport --dports http,https -s 2400:cb00::/32 -j ACCEPT
ip6tables -A INPUT -p tcp -m multiport --dports http,https -s 2606:4700::/32 -j ACCEPT

Fortunately they have the lists available as plain text files that you can fetch from time to time and incorporate into a firewall-building script.

share|improve this answer
add comment

I can't comment on how wise it is to hardcode the netblocks of your CDN, because I'm presuming you've thought this through and have a way of ensuring you're updated if they deploy systems in a new datacenter. However, I will note that you'll need to comma-separate those CIDR-notated netblocks rather than space-separating them. :)

Also: your current invocation will work once the syntax is cleaned up, but if you don't specify a rule number after -I INPUT, it will get added at the end of your chain, where you probably already have a default-deny rule. In order words: this rule won't do anything where this command is going to put it.

Best way to handle this is to find and edit your rules file, then reload it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.