≡ Menu

Linux Iptables: How to specify a range of IP addresses or ports

Someone recently asked me a question:

How can I save time and script size by specifying a range of IP addresses or ports using iptables?

In old version of iptables IP address ranges are only valid in the nat table (see below for example). However newer version does support option that allows you to specify a range of IP addresses or ports for regular tables such as input.

Iptables set range of IP addresses

You need to use following options with match extensions (-m Ext).

iprange : This matches on a given arbitrary range of IPv4 addresses.

  • [!]–src-range ip-ip: Match source IP in the specified range.
  • [!]–dst-range ip-ip: Match destination IP in the specified range.


-m iprange –src-range IP-IP -j ACTION
-m iprange –dst-range IP-IP -j ACTION

For example, allow incoming request on a port 22 for source IP in the range only. You need to add something as follows to your iptables script:

iptables -A INPUT -p tcp --destination-port 22 -m iprange --src-range -j ACCEPT  

Port range

if –protocol tcp (-p tcp) is specified, you can specify source port range with following syntax:

  • –source-port port:port
  • –sport port:port

And destination port range specification with following option :

  • –destination-port port:port
  • –dport port:port

For example block lock all incoming ssh access at port 22, for source port range 513:65535:

iptables -A INPUT -p tcp -s 0/0 --sport 513:65535 -d --dport 22 -m state --state NEW,ESTABLISHED -j DROP

On the other hand, just allow incoming ssh request with following port range:

iptables -A INPUT -p tcp -s 0/0 -d --sport 513:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s -d 0/0 --sport 22 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT

NAT table – range option

If you are using NAT table use options –to-source and –to-destination. For example IP address range:

iptables -t nat -A POSTROUTING -j SNAT --to-source

ALTERNATIVELY, try range of ports:

iptables -t nat -A POSTROUTING -j SNAT --to-source

Read man page of iptables for more information.

Share this on:

Your support makes a big difference:
I have a small favor to ask. More people are reading the nixCraft. Many of you block advertising which is your right, and advertising revenues are not sufficient to cover my operating costs. So you can see why I need to ask for your help. The nixCraft, takes a lot of my time and hard work to produce. If you use nixCraft, who likes it, helps me with donations:
Become a Supporter →    Make a contribution via Paypal/Bitcoin →   

Don't Miss Any Linux and Unix Tips

Get nixCraft in your inbox. It's free:

{ 10 comments… add one }
  • Sathish Kumar May 11, 2007, 8:07 am

    Not that much elaborate. can explain deep about SNAT and DNAT

  • abhinav narain May 5, 2009, 3:47 am

    was useful for basic information i was searching for

  • Malte September 14, 2009, 11:40 am

    this was exactly what i was looking for! thx a lot!

  • karthikeyan April 2, 2010, 6:03 pm

    For beginners this site is very use full.Through this site i had learn more things…
    thanks for nixcraft

  • bourvill February 6, 2012, 9:17 pm

    Hey! Thx for your tip’s!

  • manjeet September 6, 2012, 12:14 pm

    Can anyone help on IPTables

    I have this rule on my Linux(radhat) IPTables
    iptables -I INPUT -p tcp –syn –dport 22 -m state –state NEW,ESTABLISHED -m recent –set -j ACCEPT
    iptables -I INPUT -p tcp –syn –dport 22 -m state –state NEW -m recent –update –seconds 60 –hitcount 3 -j REJECT –reject-with tcp-reset

    but its not seems to restect per source IP address can you please update this rule for Per source IP

  • amir September 2, 2013, 1:20 pm


    iptables-restore v1.4.4: unknown option `–src-range’

  • Alex June 26, 2014, 7:15 pm

    Thank you very much! This is exactly what I need!

  • Anthony November 4, 2014, 11:31 pm

    Do you really need “–src-range ip-ip” anymore? If you just specify it like this:, this would do the whole /24 range of IPs correct or is that just in CentOS?

  • Carlos October 3, 2016, 2:29 pm

    Is it possible to specify a range of ip protocols to be blocked?

    like this:

    iptables -p 18-255 -j DROP

Leave a Comment

   Tagged with: , , , ,