Policy Accept + Allow Multiple IP's

DISCUSSION Rudi Starcevic 3 participants 4 messages Nov 15, 2004 – Nov 16, 2004 1 message not in the archive

Share & tools

Paul Annesley

2004-11-15 07:11 UTC #2 lore raw

In reply to a message not in the archive

---------- Forwarded message ----------
From: Paul Annesley <[email protected]>
Date: Mon, 15 Nov 2004 18:05:17 +1100
Subject: Re: Policy Accept + Allow Multiple IP's
To: Rudi Starcevic <[email protected]>

Quoted 8 lines · Rudi Starcevic

Hi,
I have an Iptables firewall with a default policy of accept.
I want to allow only certain IP's ssh access.
So far I have this rule which allows 1 ip:

Quoted 7 lines

iptables -A INPUT -p tcp --dport 22 -s ! xxx.xxx.xxx.xxx -j DROP
I'm not sure how to list more that 1 allowable IP.
This is a production box I've inherited so I'm hoping to work with I already have but may need to look at changing the default policy to drop or something.

Perhaps you should look at making the policy DROP and allowing specific traffic..
However what you're after can be done with two rules.. something like;

iptables -A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j DROP

Quoted 5 lines

Please advise, many thanks.
Regards Rudi

John A. Sullivan III

2004-11-15 12:07 UTC #4 lore raw

In reply to Rudi Starcevic

As Paul mentioned, I would strongly recommend a default drop policy. However, should you need the default accept, you can streamline the packet processing by using a user defined chain. This will allow any long list of allowed SSH IPs to be separated from normal packet processing:

iptables -N sshchain
iptables -A FORWARD -p 6 --dport 22 -j sshchain
iptables -A sshchain -s x.x.x.x -j ACCEPT
iptables -A sshchain -s y.y.y.y -j ACCEPT
iptables -A sshchain -s z.z.z.z -j ACCEPT
iptables -A sshchain -j DROP

Hope this helps - John

Quoted 60 lines · Rudi Starcevic

Thanks Paul,
Was hoping for a simple solution and well please to know I can do it both ways.
Many thanks
Best regards Rudi
Quoted 50 lines · Paul Annesley
---------- Forwarded message ----------
From: Paul Annesley <[email protected]>
Date: Mon, 15 Nov 2004 18:05:17 +1100
Subject: Re: Policy Accept + Allow Multiple IP's
To: Rudi Starcevic <[email protected]>
Quoted 8 lines · Rudi Starcevic
Hi,
I have an Iptables firewall with a default policy of accept.
I want to allow only certain IP's ssh access.
So far I have this rule which allows 1 ip:
Quoted 9 lines
iptables -A INPUT -p tcp --dport 22 -s ! xxx.xxx.xxx.xxx -j DROP
I'm not sure how to list more that 1 allowable IP.
This is a production box I've inherited so I'm hoping to work with I already have but may need to look at changing the default policy to drop or something.
Perhaps you should look at making the policy DROP and allowing specific traffic..
However what you're after can be done with two rules.. something like;
iptables -A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j DROP
Quoted 6 lines
Please advise, many thanks.
Regards Rudi

Signature · 9 lines

John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
[email protected]
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net

Rudi Starcevic

author

2004-11-16 00:51 UTC #0 lore raw

Hi,

I have an Iptables firewall with a default policy of accept.

I want to allow only certain IP's ssh access.

So far I have this rule which allows 1 ip:

iptables -A INPUT -p tcp --dport 22 -s ! xxx.xxx.xxx.xxx -j DROP

I'm not sure how to list more that 1 allowable IP.

This is a production box I've inherited so I'm hoping to work with I already have but may need to look at changing the default policy to drop or something.

Please advise, many thanks.
Regards Rudi

Rudi Starcevic

author

2004-11-16 01:19 UTC #3 lore raw

In reply to Paul Annesley

Thanks Paul,

Was hoping for a simple solution and well please to know I can do it both ways.

Many thanks
Best regards Rudi

Quoted 50 lines · Paul Annesley

---------- Forwarded message ----------
From: Paul Annesley <[email protected]>
Date: Mon, 15 Nov 2004 18:05:17 +1100
Subject: Re: Policy Accept + Allow Multiple IP's
To: Rudi Starcevic <[email protected]>
Quoted 8 lines · Rudi Starcevic
Hi,
I have an Iptables firewall with a default policy of accept.
I want to allow only certain IP's ssh access.
So far I have this rule which allows 1 ip:
Quoted 9 lines
iptables -A INPUT -p tcp --dport 22 -s ! xxx.xxx.xxx.xxx -j DROP
I'm not sure how to list more that 1 allowable IP.
This is a production box I've inherited so I'm hoping to work with I already have but may need to look at changing the default policy to drop or something.
Perhaps you should look at making the policy DROP and allowing specific traffic..
However what you're after can be done with two rules.. something like;
iptables -A INPUT -p tcp --dport 22 -s x.x.x.x -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j DROP
Quoted 6 lines
Please advise, many thanks.
Regards Rudi