Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Now, I want to dynamic loading a ip list file for iptables .the ip list file is the accept host , default drop . example,

iptables -A INPUT -p tcp --dport 1111 -s 2.2.2.2 -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 -j DROP
iptables -A INPUT -j ACCEPT

I mean to open a port for some one , but the ip list is dynamic,Whether I can do like below ,

iptables -A INPUT -p tcp --dport 1111 -s ip-list-file -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 -j DROP
iptables -A INPUT -j ACCEPT

ip-list-file:
2.2.2.2
3.3.3.3 

Have any idea ? Thank you .

=========================================

I look at Iptables rules sometimes are reset automatically , I can use -I ,insert the rule to head of the chain . How to realize the dynamic loading the ip list file ?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

You can't simply provide a filename to the -s parameter. If you only have a few addresses (in the order of 10s), you can use a script to add multiple rules:

while read IP; do
    iptables -A INPUT -p tcp --dport 1111 -s $IP -j ACCEPT
done < ip-list-file

If you have lots of addresses you should rather use the ipset mechanism:

ipset create list0 iphash
while read IP; do
    ipset add list0 $IP
done < ip-list-file
iptables -A INPUT -p tcp --dport 1111 -m set --match-set list0 src
share|improve this answer
    
Thanks, I am writing a web service to operate the iptables.I will use iptables -I and -D .Any good suggestions? –  Ajian Feb 1 '13 at 3:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.