Here is my iptables, how can I make it so that I can allow a range of ip's on ETH1 (10.51.x.x)

# Generated by iptables-save v1.4.4 on Thu Jul  8 13:00:14 2010
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh 
-A INPUT -i lo -j ACCEPT 
-A INPUT -d ! -i lo -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 
-A INPUT -j REJECT --reject-with icmp-port-unreachable 
-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A fail2ban-ssh -j RETURN 

If you only want to allow a certain range of IP addresses inside of (such as from through you can use the following command:

iptables -A INPUT -i eth1 -m iprange --src-range -j ACCEPT

If you want to allow the entire range you can use this instead:

iptables -A INPUT -i eth1 -s -j ACCEPT

See iptables man page and this question here on ServerFault: Whitelist allowed IPs (in/out) using iptables

  • Where do I put this line? – Mike Curry Jul 17 '10 at 19:39
  • Those are the commands that you would run from the command line: [root@host ~]# iptables -A INPUT -i eth1 -s -j ACCEPT – runlevelsix Jul 17 '10 at 21:39
  • 1
    Use "", "-80" might not do what you want. – basic6 May 24 '15 at 11:16
  • @runlevelsix If I wanted to allow for an ip range like thru, would I use ? – RoboBear Sep 30 '18 at 1:02
  • @MikeCurry this is specifying what to run on the command -line/from your terminal. Alternatively, you can add this rule to an iptables rules file in /etc/iptables/rulesets.d (if you're using Debian Linux) by removing the "iptables " and following space from the line: -A INPUT -i eth1 -m iprange --src-range -j ACCEPT. – RoboBear Sep 30 '18 at 1:05

For a specific port, say 22:

iptables -A INPUT -p tcp  -m iprange --src-range  --dport 22  -j ACCEPT

Well you did saw what you want to allow those IPs for but 10.51.x.x in CIDR translates to So it will be something like the line for the loopback interface that has

iptables -A INPUT -i eth1 -m iprange --src-range -j ACCEPT

May give the following error:

iptables: Applying firewall rules: xt_iprange: range is reversed and will never match

To correct this just put the full ip instead like this:

iptables -A INPUT -i eth1 -m iprange --src-range -j ACCEPT


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.