Add additional allowed IPs

Question

This is what I have used as reference: https://unix.stackexchange.com/a/145933

So if I do:

iptables -I INPUT -p tcp -s MY IP --dport 21 -j ACCEPT
iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 21 -j DROP

I understand that only MY IP will be able to connect to port 21. But is there a way to add another accepted IP to that?

I've tried doing:

iptables -I INPUT -p tcp -s MY OTHER IP --dport 21 -j ACCEPT

But it's still blocked, but I assume that's because the DROP is before. Could I append without dropping the DROP rule?

Can you add the relevant portion of `iptables --list --numeric` before and after your extra `iptables` command? (In particular, you can see the order of the rules in the output.) — Ulrich Schwarz, Jan 23 '16 at 18:07

score 1 · Answer 1 · answered Jan 23 '16 at 18:10

The -I option to iptables does not append (which is -A), it is used to insert a new rule. The difference is that -A adds new rules at the end of the chain, whereas, by default, -I adds new rules at the beginning of the chain.

Since chains are read in-order, it is important that your -j ACCEPT rule is processed before the -j DROP rule.

There are several ways to do that:

Use -A rather than -I to add your rule. This will ensure that the rules are added at the end, and if you do not reorder your commands, they will be in the correct order. I would recommend this over the other two options.
Continue using -I, but swap your rules. That way, the -j ACCEPT rule will be processed before the -j DROP rule.
-I optionally takes an extra argument, the location in the chain where to insert the new rule, which should be a number. Since you add the -j ACCEPT rule without any argument, that makes it the first rule (i.e., line 1); so, add the second rule on line 2:
```
iptables -I INPUT 2 -p tcp -s 0.0.0.0/0 --dport 21 `-j DROP`
```

Having said that, if you are going to have many rules like the first one, then for performance reasons it's better to create a custom chain:

iptables -N check-ftp
iptables -A check-ftp -s IP1 -j ACCEPT
iptables -A check-ftp -s IP2 -j ACCEPT
[...]
iptables -A check-ftp -j DROP
iptables -A INPUT -p tcp --dport 21 -j check-ftp

This creates a single rule for "FTP connections" in your chain. That way, if the incoming network packet is not an FTP packet, then the netfilter code will not go over the (long) list of rules to determine whether to allow this particuler packet, but move on to the next rule immediately. If it is an FTP packet, then it will go over the long list.

Add additional allowed IPs

1 Answers1