Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to allow SSH access to a certain range of IPs (from 192.168.1.1 to 192.168.1.24) and block all the rest, but since I am new to iptables I can't seem to figure it out. I have :

iptables -A INPUT -s 192.168.1.0/24 -p udp --dport ssh -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT
iptables -A INPUT -p udp --dport ssh -j REJECT

Tut this does not work, with a VM set with 192.168.1.89 I can still access through SSH. Can someone help?

share|improve this question
add comment

3 Answers

up vote 8 down vote accepted

192.168.1.0/24 is not from 1 to 24 but using 24 bits (= the 3 1st blocks) so it will accept anything starting with 192.168.1. The right one is /27 but it will allow up to 192.168.1.31.

The next smaller range will be /28 that will allow up to 192.168.1.15.

share|improve this answer
    
so how can i do this the proper way? –  psychok7 Oct 19 '12 at 3:06
1  
I was calculating that. Edited answer :) –  laurent Oct 19 '12 at 3:07
    
If you use 28, you can allow from ....1 to ...15 –  laurent Oct 19 '12 at 3:10
    
thanks thats it ;) –  psychok7 Oct 19 '12 at 3:25
    
found this calculator subnet-calculator.com –  psychok7 Oct 19 '12 at 3:30
add comment

/24 is the CIDR length, not a range.

To use a range, do this:

iptables -A INPUT -m iprange --src-range 192.168.1.1-192.168.1.24 -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT
share|improve this answer
add comment

The First DROP all INPUT Rullse ( For more security) The Second : iptables -A INPUT -p tcp -i eth0 --dport 22 -m iprange --src-range 192.168.1.1-192.168.1.24 -j ACCEPT Have good time

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.