0

I have a list access.txt

123.456.4.6

23.56.78.8

21.4.5.77

Run:

iptables -A INPUT -p tcp -s $i --dport 1234 -j ACCEPT

my question is in the access.txt list, every minute coming a new ip andress. And I need each time to do restart the iptables to get(add) the news ip andress.

How can I make to add the news ip address without restart?

0
2

Use ipset for black- or whitelists, so the iptables rule is always the same:

ipset create whitewall hash:net
ipset add whitewall 123.156.4.6
ipset add whitewall 23.56.78.8
ipset add whitewall 21.4.5.77

iptables -A INPUT -i em2 -p tcp --dport 1234 -m set --match-set whitelist src -jACCEPT

Now you can add and delete addresses from ipset or save or restore on reboot.

0

did not work where is my mystake please i have 2 list create

ipset.whitelist.conf

iptables_rules_66

#

create whitelist hash:net family inet hashsize 1024 maxelem 65536

add whitelist 22.21.78.21

add whitelist 22.22.44.5

#

Set default chain policies

*nat

:PREROUTING ACCEPT

:INPUT ACCEPT

:OUTPUT ACCEPT

:POSTROUTING ACCEPT

COMMIT

*filter

:INPUT DROP

:FORWARD DROP

:OUTPUT ACCEPT

:fail2ban-ssh - [0:0]

Fail 2 Ban rules (let them be allways first)

-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh

Allow established sessions to receive traffic

-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -s 10.0.0.0/8 -j ACCEPT

-A INPUT -p tcp -s 10.66.0.0/10 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 1963 -m set --match-set whitelist src -j

ACCEPT

-A INPUT -p tcp -m tcp --dport 1234 -m set --match-set whitelist src -j ACCEPT

-A INPUT -p tcp -m tcp --dport 80 -m set --match-set whitelist src -j ACCEPT

from second server allow everything

-A INPUT -s xx.xx.xx.x -j ACCEPT

Alow on vpn 80-1945-4546

-A INPUT -i tun0 -p tcp --dport 80 -j ACCEPT

-A INPUT -i tun0 -p tcp --dport 1945 -j ACCEPT

-A INPUT -i tun0 -p tcp --dport 7000 -j ACCEPT

-A INPUT -i tun0 -p tcp --dport 8096 -j ACCEPT

Accept on localhost

-A INPUT -i lo -j ACCEPT

-A OUTPUT -o lo -j ACCEPT

COMMIT

#

/sbin/ipset restore < /etc/ipset.whitelist.conf

/sbin/iptables-restore < /etc/iptables_rules_66

did not work

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.