Here is my iptables, how can I make it so that I can allow a range of ip's on ETH1 (10.51.x.x)

# Generated by iptables-save v1.4.4 on Thu Jul  8 13:00:14 2010
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh 
-A INPUT -i lo -j ACCEPT 
-A INPUT -d ! -i lo -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 
-A INPUT -j REJECT --reject-with icmp-port-unreachable 
-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A fail2ban-ssh -j RETURN 

4 Answers 4


If you only want to allow a certain range of IP addresses inside of (such as from through you can use the following command:

iptables -A INPUT -i eth1 -m iprange --src-range -j ACCEPT

If you want to allow the entire range you can use this instead:

iptables -A INPUT -i eth1 -s -j ACCEPT

See iptables man page and this question here on ServerFault: Whitelist allowed IPs (in/out) using iptables

  • Where do I put this line?
    – Kladskull
    Jul 17, 2010 at 19:39
  • Those are the commands that you would run from the command line: [root@host ~]# iptables -A INPUT -i eth1 -s -j ACCEPT Jul 17, 2010 at 21:39
  • 1
    Use "", "-80" might not do what you want.
    – basic6
    May 24, 2015 at 11:16
  • @runlevelsix If I wanted to allow for an ip range like thru, would I use ?
    – RoboBear
    Sep 30, 2018 at 1:02
  • @MikeCurry this is specifying what to run on the command -line/from your terminal. Alternatively, you can add this rule to an iptables rules file in /etc/iptables/rulesets.d (if you're using Debian Linux) by removing the "iptables " and following space from the line: -A INPUT -i eth1 -m iprange --src-range -j ACCEPT.
    – RoboBear
    Sep 30, 2018 at 1:05

For a specific port, say 22:

iptables -A INPUT -p tcp  -m iprange --src-range  --dport 22  -j ACCEPT

Well you did saw what you want to allow those IPs for but 10.51.x.x in CIDR translates to So it will be something like the line for the loopback interface that has

iptables -A INPUT -i eth1 -m iprange --src-range -j ACCEPT

May give the following error:

iptables: Applying firewall rules: xt_iprange: range is reversed and will never match

To correct this just put the full ip instead like this:

iptables -A INPUT -i eth1 -m iprange --src-range -j ACCEPT


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.