5

I am trying to allow SSH access to a certain range of IPs (from 192.168.1.1 to 192.168.1.24) and block all the rest, but since I am new to iptables I can't seem to figure it out. I have :

iptables -A INPUT -s 192.168.1.0/24 -p udp --dport ssh -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT
iptables -A INPUT -p udp --dport ssh -j REJECT

Tut this does not work, with a VM set with 192.168.1.89 I can still access through SSH. Can someone help?

8

192.168.1.0/24 is not from 1 to 24 but using 24 bits (= the 3 1st blocks) so it will accept anything starting with 192.168.1. The right one is /27 but it will allow up to 192.168.1.31.

The next smaller range will be /28 that will allow up to 192.168.1.15.

| improve this answer | |
  • so how can i do this the proper way? – psychok7 Oct 19 '12 at 3:06
  • 1
    I was calculating that. Edited answer :) – laurent Oct 19 '12 at 3:07
  • If you use 28, you can allow from ....1 to ...15 – laurent Oct 19 '12 at 3:10
  • found this calculator subnet-calculator.com – psychok7 Oct 19 '12 at 3:30
7

/24 is the CIDR length, not a range.

To use a range, do this:

iptables -A INPUT -m iprange --src-range 192.168.1.1-192.168.1.24 -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j REJECT
| improve this answer | |
0

The First DROP all INPUT Rullse ( For more security) The Second : iptables -A INPUT -p tcp -i eth0 --dport 22 -m iprange --src-range 192.168.1.1-192.168.1.24 -j ACCEPT Have good time

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.