It is possible using iptables (on Debian) to block all inbound connections for all the ports with a port number over (as an example) 16000.

Like this (using 16000 as reference):

The port 15999 is open for input, instead from port 16000 to 65535 inbound connections are dropped.

3 Answers 3


Use Multiport for that

iptables -A INPUT -p tcp --match multiport --dports 16000:65535 -j DROP

also you may try

iptables -A INPUT -p tcp  --dport 16000:65535 -j DROP
  • Multiport is only required if the ports are not contiguous
    – Jeff Schaller
    Apr 14, 2016 at 17:46
  • I tested the second command successfully. As Jeff says, now the ports are contiguous.
    – Marcs
    Apr 14, 2016 at 17:48
  • true :) it just to have whole picture, it is possible to do in both ways
    – vvchik
    Apr 14, 2016 at 17:51

If the ports are contiguous, like yours are, then use the

--destination-port,--dport [!] port[:port]

syntax to set up the range:

... --destination-port 16000:65535 ...

You have to block tcp and udp ports:

iptables -A INPUT -p tcp --match multiport --dports 16000:65535 -j DROP
iptables -A INPUT -p udp --match multiport --dports 16000:65535 -j DROP
  • 1
    quoting the manpage "Protocol all will match with all protocols and is taken as default when this option is omitted." (the OP didn't specify protocols)
    – Jeff Schaller
    Apr 14, 2016 at 18:10
  • The problem is that -p all makes impossible to use --dport. From server fault: serverfault.com/questions/279361/iptables-p-all-dport
    – Marcs
    Apr 14, 2016 at 18:49
  • 1
    I think -p all has problem with --dport not -p udp or -p tcp Apr 15, 2016 at 9:18
  • Yes, "-p all" doesn't makes the flag --dport available
    – Marcs
    Apr 15, 2016 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.