Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to allow SSH access to a certain range of IPs (from to and block all the rest, but since I am new to iptables I can't seem to figure it out. I have :

iptables -A INPUT -s -p udp --dport ssh -j ACCEPT
iptables -A INPUT -s -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT
iptables -A INPUT -p udp --dport ssh -j REJECT

Tut this does not work, with a VM set with I can still access through SSH. Can someone help?

share|improve this question
up vote 8 down vote accepted is not from 1 to 24 but using 24 bits (= the 3 1st blocks) so it will accept anything starting with 192.168.1. The right one is /27 but it will allow up to

The next smaller range will be /28 that will allow up to

share|improve this answer
so how can i do this the proper way? – psychok7 Oct 19 '12 at 3:06
I was calculating that. Edited answer :) – laurent Oct 19 '12 at 3:07
If you use 28, you can allow from ....1 to ...15 – laurent Oct 19 '12 at 3:10
thanks thats it ;) – psychok7 Oct 19 '12 at 3:25
found this calculator – psychok7 Oct 19 '12 at 3:30

/24 is the CIDR length, not a range.

To use a range, do this:

iptables -A INPUT -m iprange --src-range -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT
share|improve this answer

The First DROP all INPUT Rullse ( For more security) The Second : iptables -A INPUT -p tcp -i eth0 --dport 22 -m iprange --src-range -j ACCEPT Have good time

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.