How to use or specify multiple IP addresses in iptables source or destination on Linux

Posted on in Categories , , , , , last updated June 29, 2017

I need to specific multiple IP address in iptables using Linux script. How do I create a rule that uses multiple source or destination IP addresses ?

You can set multiple source (-s or --source or destination (-d or --destination) IP ranges using the following easy to use syntax.
IPTables Multiple source or Destination IP ranges
This tutorial shows you how to use multiple IP address in source or destination with IPtables on Linux.

How to add multiple sources in a single iptables command

The syntax is:
iptables -A INPUT -s ip1,ip2,ip3 -j ACCEPT
iptables -A INPUT -s ip1,ip2,ip3 -j DROP
iptables -I INPUT -s ip1,ip2,ip3 -d ip2 -j DROP

To accept 92.168.1.5 and 192.168.2.6, run:
iptables -A INPUT -s 192.168.1.5,192.168.2.6 -d 192.168.1.254 -j ACCEPT
Another example:
iptables -A INPUT -s 192.168.1.5,192.168.2.6 -d 192.168.1.254 -p tcp --dport 443 -j ACCEPT
In this example DROP packets for port 80 for two ip address:
iptables -A INPUT -s 192.168.1.5,192.168.2.6 -d 192.168.1.254 -p tcp --dport 80 -j DROP
In this example forward traffic to internal hosts for two source ip address:
source="139.59.1.155,23.239.7.187"
dest="104.20.187.5"
port=443
redirect="10.105.28.43:443"
iptables -A PREROUTING -s ${source} -d ${dest} -p tcp --dport ${port} -j DNAT --to-destination ${redirect}

It is possible to drop given IP address using a new chain as follows:

#!/bin/bash
_input="/root/block.ip.address.list.txt"
IPT=/sbin/iptables
$IPT -N droplist
egrep -v "^#|^$" x | while IFS= read -r ip
do
	$IPT -A droplist -i eth1 -s $ip -j LOG --log-prefix " myBad IP BlockList  "
	$IPT -A droplist -i eth1 -s $ip -j DROP
done < "$_input"
# Drop it 
$IPT -I INPUT -j droplist
$IPT -I OUTPUT -j droplist
$IPT -I FORWARD -j droplist

How to add multiple destination in a single iptables command

The syntax is:
iptables -A INPUT -d ip1,ip2,ip3 -j ACCEPT
iptables -A INPUT -d ip1,ip2,ip3 -j DROP
iptables -I INPUT -d ip1,ip2,ip3 -s ip2 -j DROP

Some examples:
iptables -A INPUT -d 192.168.1.5,192.168.1.6 -j ACCEPT
iptables -A INPUT -d 192.168.1.5,192.168.1.6 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -d 192.168.1.5,192.168.1.6 -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT

To view added rule run:
iptables -t filter -L INPUT -n -v
Sample outputs:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 5632 6156K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    1    80 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
  553  128K INPUT_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  553  128K INPUT_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  553  128K INPUT_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
  551  128K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited
    0     0 ACCEPT     tcp  --  *      *       192.168.1.0/24       192.168.1.5          tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       192.168.1.0/24       192.168.1.6          tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.5          tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.6          tcp dpt:22
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            192.168.1.5         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            192.168.1.6         
    0     0 ACCEPT     tcp  --  *      *       192.168.1.5          192.168.1.254        tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       192.168.2.6          192.168.1.254        tcp dpt:443

A note about user defined chain

It is possible to create a new user-defined chain as follows:
iptables -N ALLOWED
iptables -A ALLOWED -d 127.0.0.0/8 -j RETURN
iptables -A ALLOWED -d 192.168.1.0/24 -j RETURN
iptables -A ALLOWED -d 205.54.1.5 -j RETURN
iptables -A INPUT -j ALLOWED

See iptables man page for more info:
$ man iptables

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

3 comment

  1. man: ipset
    man: iptables-extension , search for ‘set’

    Also, sets can be given names so you also would benefit from knowing what a list of addresses is suposed to be.

Leave a Comment