Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have come across articles advising for the following:

iptables -A INPUT -p tcp 1000:2000 -j ACCEPT

And others stating that the above will not work and iptables only supports multiple port declarations with the --multiport option.

Is there a correct way to open many ports with iptables?

share|improve this question
    
Related question: iptables and multiple ports –  Cristian Ciupitu May 13 '14 at 18:01

3 Answers 3

up vote 13 down vote accepted

This is the correct way:

iptables -A INPUT -p tcp --match multiport --dports 1024:3000 -j ACCEPT

As an example. Source here.

share|improve this answer
3  
If you don't know the state of the ruleset -I is somewhat safer than -A. –  Iain May 13 '14 at 17:11
    
Thank you very much –  Paul Whalley May 13 '14 at 17:17
    
@Iain, could you please explain the reasoning behind that? –  jayhendren May 13 '14 at 19:04
    
@jayhendren many rulesets will have a default drop everything rule e.g. -A INPUT -j REJECT --reject-with icmp-host-prohibited at the end of the INPUT and other tables. Using -A adds the rule at the end of the table, after the final rule so it won't ever be considered as netfilter works on a first match wins basis. Using -I inserts the rule at the beginning of the table ans as such it will always be considered. –  Iain May 13 '14 at 19:14
    
@Iain however, some rulesets also have rules at the beginning that filter or ratelimit packets, so it's worthwhile to point out that -I isn't always safer if you don't know the ruleset. –  jayhendren May 13 '14 at 19:24

What you've been told is right, although you've written it wrong (you've forgotten --dport).

iptables -A INPUT -p tcp --dport 1000:2000 will open up inbound traffic to TCP ports 1000 to 2000 inclusive.

-m multiport --dports is only needed if the range you want to open is not continuous, eg -m multiport --dports 80,443, which will open up HTTP and HTTPS only - not the ones in between.

Note that the ordering of rules is important, and (as Iain alludes to in his comment elsewhere) it's your job to make sure that any rule you add is in a place where it will be effective.

share|improve this answer
    
I could allude here as well if you want ;) –  Iain May 13 '14 at 17:28
1  
Hee hee hee! Go on, then, the message is worth repeating! –  MadHatter May 13 '14 at 18:37

TL;DR but...

Pure port range without multiport module: iptables -A INPUT -p tcp --dport 1000:2000 -j ACCEPT

Equivalent multiport example: iptables -A INPUT -p tcp -m multiport --dports 1000:2000 -j ACCEPT

...and variation about multi port with multi ranges (yes, this is also possible): iptables -A INPUT -p tcp -m multiport --dports 1000,1001,1002:1500,1501:2000 -j ACCEPT

...and equivalent multi port multi range example with negation: iptables -A INPUT -p tcp -m multiport ! --dports 0:999,2001:65535 -j ACCEPT

Have phun.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.