Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Now, I want to dynamic loading a ip list file for iptables .the ip list file is the accept host , default drop . example,

iptables -A INPUT -p tcp --dport 1111 -s -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 -j DROP
iptables -A INPUT -j ACCEPT

I mean to open a port for some one , but the ip list is dynamic,Whether I can do like below ,

iptables -A INPUT -p tcp --dport 1111 -s ip-list-file -j ACCEPT
iptables -A INPUT -p tcp --dport 1111 -j DROP
iptables -A INPUT -j ACCEPT


Have any idea ? Thank you .


I look at Iptables rules sometimes are reset automatically , I can use -I ,insert the rule to head of the chain . How to realize the dynamic loading the ip list file ?

share|improve this question
up vote 5 down vote accepted

You can't simply provide a filename to the -s parameter. If you only have a few addresses (in the order of 10s), you can use a script to add multiple rules:

while read IP; do
    iptables -A INPUT -p tcp --dport 1111 -s $IP -j ACCEPT
done < ip-list-file

If you have lots of addresses you should rather use the ipset mechanism:

ipset create list0 iphash
while read IP; do
    ipset add list0 $IP
done < ip-list-file
iptables -A INPUT -p tcp --dport 1111 -m set --match-set list0 src
share|improve this answer
Thanks, I am writing a web service to operate the iptables.I will use iptables -I and -D .Any good suggestions? – Ajian Feb 1 '13 at 3:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.