Policy Accept + Allow Multiple IP's

DISCUSSION Rudi Starcevic 3 participants 4 messages Nov 15, 2004 – Nov 16, 2004 1 message not in the archive

lore

Share & tools

lore

Rudi Starcevic

author

2004-11-16 00:51 UTC #0 lore raw

Hi,

I have an Iptables firewall with a default policy of accept.

I want to allow only certain IP's ssh access.

So far I have this rule which allows 1 ip:

iptables -A INPUT -p tcp --dport 22 -s ! xxx.xxx.xxx.xxx -j DROP

I'm not sure how to list more that 1 allowable IP.

This is a production box I've inherited so I'm hoping to work with I already have but may need to look at changing the default policy to drop or something.

Please advise, many thanks.
Regards Rudi

A message that is not in the archive (sent off-list or not yet received): [email protected]

---------- Forwarded message ----------
From: Paul Annesley <[email protected]>
Date: Mon, 15 Nov 2004 18:05:17 +1100
Subject: Re: Policy Accept + Allow Multiple IP's
To: Rudi Starcevic <[email protected]>

Quoted 8 lines · Rudi Starcevic

Hi,
I have an Iptables firewall with a default policy of accept.
I want to allow only certain IP's ssh access.
So far I have this rule which allows 1 ip:

Quoted 7 lines

iptables -A INPUT -p tcp --dport 22 -s ! xxx.xxx.xxx.xxx -j DROP
I'm not sure how to list more that 1 allowable IP.
This is a production box I've inherited so I'm hoping to work with I already have but may need to look at changing the default policy to drop or something.

Perhaps you should look at making the policy DROP and allowing specific traffic..
However what you're after can be done with two rules.. something like;

iptables -A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j DROP

Quoted 5 lines

Please advise, many thanks.
Regards Rudi

Rudi Starcevic

author

2004-11-16 01:19 UTC #3 lore raw

Thanks Paul,

Was hoping for a simple solution and well please to know I can do it both ways.

Many thanks
Best regards Rudi

Quoted 50 lines · Paul Annesley

---------- Forwarded message ----------
From: Paul Annesley <[email protected]>
Date: Mon, 15 Nov 2004 18:05:17 +1100
Subject: Re: Policy Accept + Allow Multiple IP's
To: Rudi Starcevic <[email protected]>
Quoted 8 lines · Rudi Starcevic
Hi,
I have an Iptables firewall with a default policy of accept.
I want to allow only certain IP's ssh access.
So far I have this rule which allows 1 ip:
Quoted 9 lines
iptables -A INPUT -p tcp --dport 22 -s ! xxx.xxx.xxx.xxx -j DROP
I'm not sure how to list more that 1 allowable IP.
This is a production box I've inherited so I'm hoping to work with I already have but may need to look at changing the default policy to drop or something.
Perhaps you should look at making the policy DROP and allowing specific traffic..
However what you're after can be done with two rules.. something like;
iptables -A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j DROP
Quoted 6 lines
Please advise, many thanks.
Regards Rudi

John A. Sullivan III

2004-11-15 12:07 UTC #4 lore raw

As Paul mentioned, I would strongly recommend a default drop policy. However, should you need the default accept, you can streamline the packet processing by using a user defined chain. This will allow any long list of allowed SSH IPs to be separated from normal packet processing:

iptables -N sshchain
iptables -A FORWARD -p 6 --dport 22 -j sshchain
iptables -A sshchain -s x.x.x.x -j ACCEPT
iptables -A sshchain -s y.y.y.y -j ACCEPT
iptables -A sshchain -s z.z.z.z -j ACCEPT
iptables -A sshchain -j DROP

Hope this helps - John

Quoted 60 lines · Rudi Starcevic

Thanks Paul,
Was hoping for a simple solution and well please to know I can do it both ways.
Many thanks
Best regards Rudi
Quoted 50 lines · Paul Annesley
---------- Forwarded message ----------
From: Paul Annesley <[email protected]>
Date: Mon, 15 Nov 2004 18:05:17 +1100
Subject: Re: Policy Accept + Allow Multiple IP's
To: Rudi Starcevic <[email protected]>
Quoted 8 lines · Rudi Starcevic
Hi,
I have an Iptables firewall with a default policy of accept.
I want to allow only certain IP's ssh access.
So far I have this rule which allows 1 ip:
Quoted 9 lines
iptables -A INPUT -p tcp --dport 22 -s ! xxx.xxx.xxx.xxx -j DROP
I'm not sure how to list more that 1 allowable IP.
This is a production box I've inherited so I'm hoping to work with I already have but may need to look at changing the default policy to drop or something.
Perhaps you should look at making the policy DROP and allowing specific traffic..
However what you're after can be done with two rules.. something like;
iptables -A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j DROP
Quoted 6 lines
Please advise, many thanks.
Regards Rudi

Signature · 9 lines

John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
[email protected]
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net