I would like to allow a certain IP addresses or a whole network (source) to reach my servers with ssh connection and to drop all other unauthorized source IP addresses.

  • Have a look at Secure SSH Access you can also limit access directly within the ssh daemon
    – edgelab
    Jun 29, 2015 at 12:35

3 Answers 3

iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED --source x.x.x.x -p tcp --dport 22 -j ACCEPT

access only from x.x.x.x

iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport 22 -j DROP

drop all other packets to port 22

  • 1
    Hopefully the default rule is REJECT in which case you wouldn't have to define the second rule.
    – dunxd
    Jul 29, 2011 at 15:12
  • 1
    Note that this answer assumes that the OUPUT chain is unrestricted. First question is what security does filtering by state add to the first rule if you include all of the states except INVALID? Couldn't you remove RELATED from the rule? Second question is doesn't filtering by state on the second rule miss packets with state INVALID? Why not just drop the state filtering entirely on the second rule? Jan 20, 2015 at 18:56
iptables -A INPUT -p tcp -s --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT

There are other ways to do it, but this is simplest when we know nothing about your other rules.

  • Why the /16? Is it for dynamic ip from isp? Would not need for static ip I assume?
    – jjxtra
    Feb 27, 2022 at 17:48

Sometimes command line IpTables syntax can be a bit much to learn/digest. If you're new(ish) to linux administration; you might consider installing something like webmin. You can use their gui to create your rules, and then go back and check the "/etc/sysconfig/iptables" file and see the actual syntax.

I would then recommend using Webmin & IpTables to lock down webin access to only those specific IP addresses you wish. You use the same syntax as some of the other posters have answered, just changing the PORT to whatever you setup Webmin to use. (Hopefully something OTHER than the standard port:10000).

  • I'd like to understand why someone would vote this down? Is this considered unhelpful? Poorly written? I'd genuinely appreciate the constructive criticism.
    – RealITGuy
    Jul 30, 2011 at 13:11
  • Hi, I was not the one who voted you down but I think the idea on this post was to harden the Server security. Some may believe that adding "webmin" is actually weakening the security since you are introducing yet another attack-able surface: cvedetails.com/vulnerability-list/vendor_id-358/Webmin.html
    – Milan
    Mar 3, 2017 at 17:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .