iptables multiple source IPs

Question

I'd like to create a single rule in iptables (if possible) that uses multiple source IP addresses. Is this possible?

Answer 1

This is only possible if you can aggregate the source IP's you want into a contiguous range. eg

iptables -A INPUT -s 192.168.0.0/24 -d 192.168.0.5 -p tcp -j ACCEPT

If you cannot find a common netmask that covers the IP's you want, you'll have to write several identical rules to do what you want.

There are several iptables frameworks around which can deal with the low level of writing the iptables rules, allowing you to define your rules at a more symolic level. Shorewall is a common one that ships with most current linux distributions.

Answer 2

You can define multiple chains such that you can combine independent lists of requirements. I doubt this is exactly what you want, but it's still pretty handy. We use this to define lists of valid user-types by IP, and then apply port restrictions to the source networks. So, for instance:

# Allow SMTP from anywhere
-A tcp_inbound -p tcp -m tcp -s 0/0 --dport 25 -j allowed
#
# Define the set of IP ranges we'll send to the tcp_user_inbound chain
-A tcp_inbound -p tcp -m tcp -s 172.19.1.0/24 -j tcp_user_inbound
-A tcp_inbound -p tcp -m tcp -s 172.19.6.0/23 -j tcp_user_inbound
-A tcp_inbound -p tcp -m tcp -s 172.19.8.0/24 -j tcp_user_inbound
-A tcp_inbound -p tcp -m tcp -s 172.19.10.0/23 -j tcp_user_inbound
-A tcp_inbound -p tcp -m tcp -s 172.19.12.0/23 -j tcp_user_inbound
-A tcp_inbound -p tcp -m tcp -s 172.19.4.0/23 -j tcp_user_inbound
#
# Ports we allow access to based on a source-address prereq.
# SSH
-A tcp_user_inbound -p tcp -m tcp --dport 22 -j allowed
# VNC
-A tcp_user_inbound -p tcp -m tcp --dport 5950:5958 -j allowed
# https
-A tcp_user_inbound -p tcp -m tcp --dport 443 -j allowed