Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using IPSet to build IP ranges for different countries as follows :

# Canada
ipset -F ca.zone
ipset -N ca.zone nethash
for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone)
        do ipset -A ca.zone $IP 
        echo $IP
done

I'm then blocking those countries from certain ports on my server with the following iptables rules :

iptables -A INPUT -m set --match-set fr.zone src -p tcp --dport 15765 -j DROP
iptables -A INPUT -m set --match-set cn.zone src -p tcp --dport 15765 -j DROP
iptables -A INPUT -m set --match-set ca.zone src -p tcp --dport 16247 -j DROP
iptables -A INPUT -m set --match-set de.zone src -p tcp --dport 16247 -j DROP

This all works well but I want to achieve the opposite of this for some of the ports by only allowing certain IPSet country ip ranges. For example block all IP's apart from those inside my uk.zone and th.zone sets.

What iptables rules would I need to achieve this ?

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

Reverse the presumption: allow through those that you want, then deny the rest:

iptables -A INPUT -m set --match-set uk.zone src -p tcp --dport 15765 -j ACCEPT
iptables -A INPUT -m set --match-set th.zone src -p tcp --dport 15765 -j ACCEPT
iptables -A INPUT                                -p tcp --dport 15765 -j DROP

(and similarly for port 16247, or try getting clever with -m multiport). Note that the order is important: the exceptions (ACCEPTs) need to come before the rule (DROP).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.