How do you specify an odd group of hosts?

I am wondering what is the best way to specify an odd group of hosts. For example, I want to allow managment hosts access to 192.168.0.5. The managment hosts are 192.168.1.4, 192.168.1.12, 192.168.1.96.

As far as I can tell from the iptables docs you can only specify groups by netmask according to the following extract from the packet filtering HOWTO:
*******************************************************
The third and fourth ways allow specification of a group of IP addresses, such as 199.95.207.0/24' or 199.95.207.0/255.255.255.0'. These both specify any IP address from 199.95.207.0 to 199.95.207.255 inclusive; the digits after the /' tell which parts of the IP address are significant. /32' or /255.255.255.255' is the default (match all of the IP address). To specify any IP address at all /0' can be used, like so:
*******************************************************

This will not work with odd hosts such as the management hosts above.

Should I create a managment chain where I list all the managment hosts and accept the packet if it matches a managment host and use this chain as the target?

eg:
iptables -A FORWARD -p tcp -d 192.168.0.5 --dport 22 -j MNG_HOST

iptables -A MNG_HOST -s 192.168.1.4 -j ACCEPT
iptables -A MNG_HOST -s 192.168.1.12 -j ACCEPT
iptables -A MNG_HOST -s 192.168.1.96 -j ACCEPT
iptables -A MNG_HOST -j DENY

I think this could be a little cumbersome when dealing with large numbers of hosts. Maybe a comma separated list of source hosts would be good, or a way to group.

Adrian.

UTS CRICOS Provider Code: 00099F

DISCLAIMER
========================================================================
This email message and any accompanying attachments may contain confidential information. If you are not the intended recipient, do not read, use, disseminate, distribute or copy this message or attachments. If you have received this message in error, please notify the sender immediately and delete this message. Any views expressed in this message are those of the individual sender, except where the sender expressly, and with authority, states them to be the views the University of Technology Sydney. Before opening any attachments, please check them for viruses and defects.
========================================================================

Looks like the best way of doing it to me. There's no way to specify
multiple source or destination addresses in a single iptables rule except for the contiguous network ranges you've already found in the docs.

Antony.

This is what I did ... write a script! You could have several parts, one for accepted hosts, etc... I actually had certain ports that I had a bunch of eggdrops allowed access on... listed the rules for the ports and added the IPs to the first line ...

for i in a.b.c.d e.f.g.h i.j.k.l
do
iptables -A inet-in -s $i -j ACCEPT
done