IPTABLES

[Jonathan Morrison]

Could anyone point me to a good IPTABLES protocol to reject all incoming traffic except for a single IP or IP range?

Thanks,

Jonathan.

[Steven E. Protter]

Shalom Jonathan,

Here is a good tutorial.
http://www.cyberciti.biz/tips/linux-iptables-how-to-specify-a-range-of-ip-addresses-or-ports.html

SEO

[Jonathan Morrison]

Thanks for the link, I have read the tutorial but I thought there was more to it than simply running something like:

iptables -A INPUT -p tcp --destination-port 22 -m iprange --src-range 192.168.1.100-192.168.1.200 -j ACCEPT

At the command prompt. Is there no 'DROP everything else' also nededed?

Ta,

Jon.

[J. Maestre]

Before setting up specific rules you should configure a default rule for each chain (it might be set already, check with "iptables -L INPUT").

To set a default DROP rule for INPUT:

iptables -P INPUT DROP

[loco_vikide]

You might want to do something similar to this:

:INPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 22 -s 192.168.0.0/24 -j ACCEPT
-A INPUT -p tcp -m state --state ESTABLISHED,RELATED --dport 22 -s 192.168.0.0/24 -j ACCEPT

You could substitute the range of IPs with a specific IP address.

Cheers